Skip to main content

knurl

Rock-solid primitives for content-addressable hashing, chain fingerprinting, and config diffing.

Extracted from the SpiritEngine project.

Modules

  • canon - Canonical JSON serialization (RFC 8785 + mandatory Unicode NFC normalization). Deterministic, byte-identical across implementations and Python versions. Floats are rejected by default (pass accept_floats=True for non-hash use); integers keep their exact digits; NaN/Infinity, unassigned code points, and duplicate-after-NFC keys raise CanonError.
  • hash - Content-addressable hashing
  • chain - Merkle-like chain fingerprinting
  • diverge - Divergence detection for fingerprint chains
  • diff - JSON Patch (RFC 6902) diffs
  • yield_ - Yield data serialization

Installation

pip install knurl

# With diff support (requires jsonpatch)
pip install knurl[diff]

Usage

from knurl import canon, hash, chain, diverge

# Canonical serialization
canonical_bytes = canon.serialize({"b": 1, "a": 2})  # b'{"a":2,"b":1}'

# Content-addressable hashing
content_hash = hash.compute("hello world")        # 'sha256:...' (strings)
blob_hash = hash.compute_bytes(b"\x00\x01\x02")   # 'sha256:...' (raw bytes)
file_hash = hash.compute_file("video.mp4")        # 'sha256:...' (streamed, multi-GB safe)
tree_hash = hash.compute_tree("mirror/")          # 'sha256:...' (reproducible directory digest)

# Same walk, but keep the per-file content hashes (for content-addressed dedup)
manifest = hash.compute_tree_manifest("mirror/")  # TreeManifest(digest, entries, paths)
manifest.digest                                   # == compute_tree("mirror/")
manifest.entries["index.html"]                    # {'type': 'file', 'hash': 'sha256:...'} (NFC key)
manifest.paths["index.html"]                      # real on-disk relative path, to re-read the bytes

# Chain fingerprinting
fingerprints = chain.fingerprint([config1, config2, config3])

# Divergence detection
result = diverge.find(old_fingerprints, new_fingerprints)

Requirements

  • Python 3.10+
  • No dependencies (stdlib only)
  • Optional: jsonpatch for diff module

Metadata

Release files for knurl 0.5.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for knurl 0.5.0
File Size Uploaded Provenance
knurl-0.5.0.tar.gz 128.9 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for knurl 0.5.0
File Interpreter ABI Platform
knurl-0.5.0-py3-none-any.whl Python 3 none any Details

Total release size: 161.9 kB

Release files / knurl-0.5.0.tar.gz

Download URL knurl-0.5.0.tar.gz
Size 128.9 kB
Tags Source
SHA-256 checksum
How to use checksums
7b84648be2a08d0bf8dbd776fd234501496dd251631a18fdd037f9f75a8c774f
BLAKE2b-256 checksum
How to use checksums
ee20879de2f7627247c3ea94f40f724d9074bc2b215966a07bddb0d471e34147
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 6, 2026.

Transparency log

Release files / knurl-0.5.0-py3-none-any.whl

Download URL knurl-0.5.0-py3-none-any.whl
Size 33.0 kB
Tags Python 3
SHA-256 checksum
How to use checksums
fd041c39683287ab21e35d2e9197339a0381c12482f0c76cca870e14fc61b9e9
BLAKE2b-256 checksum
How to use checksums
d560f7c3644a9708c280dd938d3c580433b4019cb37f2e608106e9a32729a550
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 6, 2026.

Transparency log

Security for knurl 0.5.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for knurl-0.5.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 6, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page