swarmauri_signing_dsse 0.11.0.dev1

Composable DSSE envelope adapter that layers Pre-Authentication Encoding onto Swarmauri signing providers

Swarmauri Signing DSSE

DSSESigner layers the in-toto DSSE envelope format on top of any existing Swarmauri signer. It computes the Pre-Authentication Encoding (PAE) defined by the spec, delegates raw signing and verification to the wrapped provider, and exposes helpers for serializing envelopes in the DSSE JSON representation.

Features

• Adds the dsse-pae canonicalization surface to any SigningBase provider.
• Supports detached signature workflows for bytes, digests, streams, and envelopes.
• Includes a strict JSON codec with typed helpers for building and inspecting DSSE envelopes.
• Maintains the inner signer's capability matrix while declaring DSSE-specific features (detached_only, multi).

Installation

Install the package with your preferred Python packaging tool:

Using uv

uv add swarmauri_signing_dsse

Using pip

pip install swarmauri_signing_dsse

Usage

import base64

from swarmauri_signing_dsse import DSSESigner, DSSEEnvelope
from swarmauri_signing_ed25519 import Ed25519EnvelopeSigner

# Wrap an existing Swarmauri signer.
inner_signer = Ed25519EnvelopeSigner()
dsse_signer = DSSESigner(inner_signer)

# Prepare a DSSE envelope.
payload = b"example payload"
payload_b64 = base64.urlsafe_b64encode(payload).decode("ascii").rstrip("=")
envelope = DSSEEnvelope(payload_type="text/plain", payload_b64=payload_b64)

# Sign and verify using DSSE PAE over the payload.
key_ref = {"kind": "raw_ed25519_sk", "bytes": b"\x01" * 32}
signatures = await dsse_signer.sign_envelope(key_ref, envelope)
assert await dsse_signer.verify_envelope(envelope, signatures)

DSSESigner accepts existing DSSE JSON mappings or bytes anywhere an envelope is expected. The helper methods encode_envelope() and decode_envelope() let you round-trip envelopes without reimplementing JSON handling.

License

This project is licensed under the Apache License 2.0.