sign-and-verify

Python library implementing the Sign-and-Verify methodology: SAVSigner (owns a KERI AID, issues Foreign Artifact Wrapper and Dossier credentials, validates external AIDs' signatures) and SAVVerifier (cryptographically verifies a presented Dossier CESR stream).

Install

pip install sign-and-verify

Requires Python 3.12+ and the native libsodium library (needed by keri).

Setup (development)

1. Install dependencies: uv sync --group dev
2. Run the test suite (no network/witness pool required): uv run pytest
3. To actually issue credentials against a real keystore:
   • Start a kli witness demo pool and a vlei-server serving the FAW/Dossier schemas (see the vLEI repo's schema/acdc/foreign-artifact-wrapper.json and schema/acdc/dossier.json — these must be saidified and published first).
   • Run scripts/incept-signer-aid.sh once (with SIGNER_NAME, SIGNER_BASE, SIGNER_ALIAS, SIGNER_PASS set) to incept the signer's AID and its two credential registries.
   • See examples/basic_usage.py.
4. To verify a presented Dossier CESR stream (built via export_credential, see below): SAVVerifier(VerifierConfig(...)).verify_presentation(cesr, said) — a fresh, throwaway local KERI store; a verifier controls no AID and issues nothing, so VerifierConfig needs only schema_oobis beyond the keystore location.

Package layout

• src/sign_and_verify/signer.py — SAVSigner, the issuance-side public facade.
• src/sign_and_verify/verifying.py — SAVVerifier: verify_presentation() (crypto validity via keripy's Parser/Verifier) and check_revocation() (direct witness TEL query; does not cryptographically verify the revocation event itself — see its docstring for why that's an intentional, precedented choice).
• src/sign_and_verify/utils.py — export_credential(): serializes a credential's full CESR proof (KEL + TEL + chained edge credentials, recursively, each edge fully introduced before anything that references it + the credential's own ACDC last) into one presentable stream.
• src/sign_and_verify/dossier.py — generic Dossier reading and checking (read_dossier, check_dossier, check_authority_edge) and file-to-FAW matching (match_files); no vLEI, no project policy.
• src/sign_and_verify/store.py — CredentialStore protocol and its keripy-backed KeriCredentialStore.
• src/sign_and_verify/vlei.py — optional vLEI ECR chain rules (verify_authority_chain); the core never imports it.
• src/sign_and_verify/environment.py, verifier_environment.py — open an existing signer/verifier keystore (never incepts an AID).
• src/sign_and_verify/doers.py, issuance.py, resolvers.py, validation.py — supporting modules for the issue-and-wait pattern, schema/OOBI resolution, and signature validation.
• src/sign_and_verify/config.py, verifier_config.py, errors.py — settings and error types.
• scripts/ — kli-based AID/registry inception tooling.