Class swarmauri_signing_ssh.SshEnvelopeSigner.SshEnvelopeSigner

swarmauri_signing_ssh.SshEnvelopeSigner.SshEnvelopeSigner

Bases: SigningBase

Create and verify OpenSSH detached signatures.

This signer invokes ssh-keygen -Y to produce and validate sshsig signatures for raw byte payloads or canonicalized envelopes.

type class-attribute instance-attribute

type = 'SigningBase'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Declare supported algorithms and canonicalization formats.

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

def supports(self) -> Mapping[str, Iterable[str]]:
    """Declare supported algorithms and canonicalization formats."""

    canons = ("json", "cbor") if _CBOR_OK else ("json",)
    envelopes = ("detached-bytes", "ssh-signed-envelope") + tuple(
        f"structured-{canon}" for canon in canons
    )
    algs = (
        "ssh-ed25519",
        "ssh-rsa",
        "rsa-sha2-256",
        "rsa-sha2-512",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
    )
    return {
        "algs": algs,
        "canons": canons,
        "signs": ("bytes", "digest", "envelope", "stream"),
        "verifies": ("bytes", "digest", "envelope", "stream"),
        "envelopes": ("mapping", *envelopes),
        "features": ("multi", "detached_only"),
    }

sign_bytes async

sign_bytes(key, payload, *, alg=None, opts=None)

Sign a payload and return detached SSH signatures.

PARAMETER	DESCRIPTION
key	Reference to the private key used for signing. TYPE: KeyRef
payload	Raw data to sign. TYPE: bytes
alg	Algorithm override. Defaults to None. TYPE: Optional[Alg] DEFAULT: None
opts	Extra options such as namespace or hashalg. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None

RETURNS	DESCRIPTION
Sequence[Signature]	Sequence[Signature]: The generated signature collection.

RAISES	DESCRIPTION
RuntimeError	If ssh-keygen is unavailable or signing fails.
TypeError	If the key reference is invalid.

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def sign_bytes(
    self,
    key: KeyRef,
    payload: bytes,
    *,
    alg: Optional[Alg] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> Sequence[Signature]:
    """
    Sign a payload and return detached SSH signatures.

    Args:
        key (KeyRef): Reference to the private key used for signing.
        payload (bytes): Raw data to sign.
        alg (Optional[Alg]): Algorithm override. Defaults to ``None``.
        opts (Optional[Mapping[str, object]]): Extra options such as
            ``namespace`` or ``hashalg``. Defaults to ``None``.

    Returns:
        Sequence[Signature]: The generated signature collection.

    Raises:
        RuntimeError: If ``ssh-keygen`` is unavailable or signing fails.
        TypeError: If the key reference is invalid.
    """

    _require_ssh_keygen()

    priv_path, identity, keytype = _resolve_privkey_to_path(key)
    temp_key = None
    if isinstance(key, dict) and key.get("kind") == "pem":
        temp_key = priv_path

    namespace = str((opts or {}).get("namespace") or "file")
    hashalg = (
        (key.get("hashalg") if isinstance(key, dict) else None)
        or (opts or {}).get("hashalg")
        or ("sha256" if keytype == "ssh-rsa" else None)
    )
    pub_line = _extract_pub_from_priv(priv_path)
    kid = _fingerprint_from_publine(pub_line)
    alg_token = _alg_token_from_keytype(keytype, hashalg)

    cmd = ["ssh-keygen", "-Y", "sign", "-f", priv_path, "-n", namespace]
    if hashalg in ("sha256", "sha512"):
        cmd += ["-O", f"hashalg={hashalg}"]

    try:
        _, sig, _ = _run(cmd, stdin=payload, check=True)
        return [
            _Sig(
                {
                    "alg": alg_token,
                    "kid": kid,
                    "sig": sig,
                    "format": "sshsig",
                    "namespace": namespace,
                    "identity": identity,
                    "keytype": keytype,
                }
            )
        ]
    finally:
        if temp_key:
            try:
                os.remove(temp_key)
            except Exception:  # pragma: no cover - cleanup best-effort
                pass

verify_bytes async

verify_bytes(
    payload, signatures, *, require=None, opts=None
)

Verify SSH signatures for a payload.

PARAMETER	DESCRIPTION
payload	Original message that was signed. TYPE: bytes
signatures	Signatures to verify. TYPE: Sequence[Signature]
require	Verification constraints such as min_signers, algs or kids. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None
opts	Options including pubkeys with a list of SSH public key lines and optional namespace or identity. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None

RETURNS	DESCRIPTION
bool	True if verification succeeds, otherwise False. TYPE: bool

RAISES	DESCRIPTION
RuntimeError	If required options are missing or verification fails.
TypeError	If provided public keys or signatures are malformed.

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def verify_bytes(
    self,
    payload: bytes,
    signatures: Sequence[Signature],
    *,
    require: Optional[Mapping[str, object]] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bool:
    """
    Verify SSH signatures for a payload.

    Args:
        payload (bytes): Original message that was signed.
        signatures (Sequence[Signature]): Signatures to verify.
        require (Optional[Mapping[str, object]]): Verification constraints
            such as ``min_signers``, ``algs`` or ``kids``. Defaults to ``None``.
        opts (Optional[Mapping[str, object]]): Options including ``pubkeys``
            with a list of SSH public key lines and optional ``namespace`` or
            ``identity``. Defaults to ``None``.

    Returns:
        bool: ``True`` if verification succeeds, otherwise ``False``.

    Raises:
        RuntimeError: If required options are missing or verification fails.
        TypeError: If provided public keys or signatures are malformed.
    """

    _require_ssh_keygen()

    req = require or {}
    min_signers = int(req.get("min_signers", 1))
    allowed_algs = set(req.get("algs") or [])
    required_kids = set(req.get("kids") or [])

    namespace = str((opts or {}).get("namespace") or "file")
    identity_hint = (opts or {}).get("identity")
    pubkeys = (opts or {}).get("pubkeys") or []
    if not isinstance(pubkeys, (list, tuple)) or not pubkeys:
        raise RuntimeError(
            "SshEnvelopeSigner.verify_bytes requires opts['pubkeys'] with one or more SSH public keys."
        )

    allowed_lines = []
    for idx, key_entry in enumerate(pubkeys):
        if not isinstance(key_entry, str):
            raise TypeError(
                "opts['pubkeys'] entries must be OpenSSH public key lines (str)."
            )
        identity = str(identity_hint or f"signer{idx}")
        allowed_lines.append(_allowed_signers_content(identity, key_entry))
    allowed_blob = b"".join(allowed_lines)
    allowed_path = _write_temp("ssh_allowed_", allowed_blob, mode=0o600)

    try:
        accepted = 0
        for sig in signatures:
            sig_bytes = sig.get("sig")
            if not isinstance(sig_bytes, (bytes, bytearray)):
                continue
            keytype = str(sig.get("keytype") or "")
            if allowed_algs and (
                sig.get("alg") not in allowed_algs and keytype not in allowed_algs
            ):
                continue
            if required_kids:
                kid = sig.get("kid")
                if not isinstance(kid, str) or kid not in required_kids:
                    continue

            sig_path = _write_temp("ssh_sig_", bytes(sig_bytes), mode=0o600)
            try:
                cmd = [
                    "ssh-keygen",
                    "-Y",
                    "verify",
                    "-f",
                    allowed_path,
                    "-I",
                    str(sig.get("identity") or identity_hint or "signer0"),
                    "-n",
                    str(sig.get("namespace") or namespace),
                    "-s",
                    sig_path,
                ]
                rc, _, _ = _run(cmd, stdin=payload, check=False)
                if rc == 0:
                    accepted += 1
                    if accepted >= min_signers:
                        return True
            finally:
                os.remove(sig_path)
        return False
    finally:
        os.remove(allowed_path)

sign_digest async

sign_digest(key, digest, *, alg=None, opts=None)

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def sign_digest(
    self,
    key: KeyRef,
    digest: bytes,
    *,
    alg: Optional[Alg] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> Sequence[Signature]:
    return await self.sign_bytes(key, digest, alg=alg, opts=opts)

verify_digest async

verify_digest(
    digest, signatures, *, require=None, opts=None
)

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def verify_digest(
    self,
    digest: bytes,
    signatures: Sequence[Signature],
    *,
    require: Optional[Mapping[str, object]] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bool:
    return await self.verify_bytes(digest, signatures, require=require, opts=opts)

canonicalize_envelope async

canonicalize_envelope(env, *, canon=None, opts=None)

Serialize an envelope to a canonical byte representation.

PARAMETER	DESCRIPTION
env	Envelope to canonicalize. TYPE: Envelope
canon	Canonicalization format ("json" or "cbor"). Defaults to "json". TYPE: Optional[Canon] DEFAULT: None
opts	Additional options. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None

RETURNS	DESCRIPTION
bytes	Canonicalized envelope bytes. TYPE: bytes

RAISES	DESCRIPTION
ValueError	If the requested canonicalization format is unsupported.

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def canonicalize_envelope(
    self,
    env: Envelope,
    *,
    canon: Optional[Canon] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bytes:
    """
    Serialize an envelope to a canonical byte representation.

    Args:
        env (Envelope): Envelope to canonicalize.
        canon (Optional[Canon]): Canonicalization format (``"json"`` or
            ``"cbor"``). Defaults to ``"json"``.
        opts (Optional[Mapping[str, object]]): Additional options. Defaults
            to ``None``.

    Returns:
        bytes: Canonicalized envelope bytes.

    Raises:
        ValueError: If the requested canonicalization format is unsupported.
    """

    if canon in (None, "json"):
        return _canon_json(env)  # type: ignore[arg-type]
    if canon == "cbor":
        return _canon_cbor(env)  # type: ignore[arg-type]
    raise ValueError(f"Unsupported canon: {canon}")

sign_envelope async

sign_envelope(key, env, *, alg=None, canon=None, opts=None)

Sign a structured envelope.

PARAMETER	DESCRIPTION
key	Reference to the private key used for signing. TYPE: KeyRef
env	Envelope to sign. TYPE: Envelope
alg	Algorithm override. Defaults to None. TYPE: Optional[Alg] DEFAULT: None
canon	Canonicalization format. Defaults to "json". TYPE: Optional[Canon] DEFAULT: None
opts	Extra options forwarded to :meth:sign_bytes. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None

RETURNS	DESCRIPTION
Sequence[Signature]	Sequence[Signature]: The generated signature collection.

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def sign_envelope(
    self,
    key: KeyRef,
    env: Envelope,
    *,
    alg: Optional[Alg] = None,
    canon: Optional[Canon] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> Sequence[Signature]:
    """
    Sign a structured envelope.

    Args:
        key (KeyRef): Reference to the private key used for signing.
        env (Envelope): Envelope to sign.
        alg (Optional[Alg]): Algorithm override. Defaults to ``None``.
        canon (Optional[Canon]): Canonicalization format. Defaults to
            ``"json"``.
        opts (Optional[Mapping[str, object]]): Extra options forwarded to
            :meth:`sign_bytes`. Defaults to ``None``.

    Returns:
        Sequence[Signature]: The generated signature collection.
    """

    payload = await self.canonicalize_envelope(env, canon=canon, opts=opts)
    return await self.sign_bytes(key, payload, alg=alg, opts=opts)

verify_envelope async

verify_envelope(
    env, signatures, *, canon=None, require=None, opts=None
)

Verify signatures over a structured envelope.

PARAMETER	DESCRIPTION
env	Envelope data to verify. TYPE: Envelope
signatures	Signatures to validate. TYPE: Sequence[Signature]
canon	Canonicalization format. Defaults to "json". TYPE: Optional[Canon] DEFAULT: None
require	Verification constraints as described in :meth:verify_bytes. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None
opts	Extra options forwarded to :meth:verify_bytes. Defaults to None. TYPE: Optional[Mapping[str, object]] DEFAULT: None

RETURNS	DESCRIPTION
bool	True if verification succeeds, otherwise False. TYPE: bool

Source code in swarmauri_signing_ssh/SshEnvelopeSigner.py

async def verify_envelope(
    self,
    env: Envelope,
    signatures: Sequence[Signature],
    *,
    canon: Optional[Canon] = None,
    require: Optional[Mapping[str, object]] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bool:
    """
    Verify signatures over a structured envelope.

    Args:
        env (Envelope): Envelope data to verify.
        signatures (Sequence[Signature]): Signatures to validate.
        canon (Optional[Canon]): Canonicalization format. Defaults to
            ``"json"``.
        require (Optional[Mapping[str, object]]): Verification constraints as
            described in :meth:`verify_bytes`. Defaults to ``None``.
        opts (Optional[Mapping[str, object]]): Extra options forwarded to
            :meth:`verify_bytes`. Defaults to ``None``.

    Returns:
        bool: ``True`` if verification succeeds, otherwise ``False``.
    """

    payload = await self.canonicalize_envelope(env, canon=canon, opts=opts)
    return await self.verify_bytes(payload, signatures, require=require, opts=opts)

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

sign_stream async

sign_stream(key, payload, *, alg=None, opts=None)

Source code in swarmauri_base/signing/SigningBase.py

async def sign_stream(
    self,
    key: KeyRef,
    payload: ByteStream,
    *,
    alg: Optional[Alg] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> Sequence[Signature]:
    data = await _stream_to_bytes(payload)
    return await self.sign_bytes(key, data, alg=alg, opts=opts)

verify_stream async

verify_stream(
    payload, signatures, *, require=None, opts=None
)

Source code in swarmauri_base/signing/SigningBase.py

async def verify_stream(
    self,
    payload: ByteStream,
    signatures: Sequence[Signature],
    *,
    require: Optional[Mapping[str, object]] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bool:
    data = await _stream_to_bytes(payload)
    return await self.verify_bytes(data, signatures, require=require, opts=opts)