feat: implement Ed25519 signing, commit uv.lock - #29
Merged
Merged
Conversation
The docstring promised Ed25519 but only HMAC-SHA256 with a shared secret existed — anyone holding the secret (every verifier) could forge signatures. Implement Ed25519 as an additive mode: - keygen subcommand generates an Ed25519 keypair (private PEM chmod 0600, public PEM safe to commit/pin) - sign/verify gain --ed25519; --key accepts literal PEM or a PEM file path - keys fall back to SKILLS_ED25519_PRIVATE_KEY / SKILLS_ED25519_PUBLIC_KEY env vars, mirroring how the HMAC secret is sourced from CI secrets - sign output now records its algorithm (hmac-sha256 or ed25519) - publish-registry workflow prefers Ed25519 when the SKILLS_ED25519_PRIVATE_KEY secret exists, else falls back to legacy HMAC so CI keeps working; making Ed25519 mandatory is a follow-up - fix the docstring to describe both schemes accurately - cryptography added to dependencies (lazy-imported, HMAC path stays stdlib-only) Legacy HMAC functions keep their signatures; existing tests unchanged.
The repo ships a Dockerfile and pyproject.toml, so dependency resolution should be pinned for reproducibility; uv.lock was listed under a 'Temporary' section of .gitignore and never committed. uv lock --check verifies the lockfile matches pyproject (including the new cryptography dependency).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sign_manifest.pynow supports--ed25519mode (additive, alongside HMAC; CI stays green). Key sourcing mirrors HMAC: envSKILLS_ED25519_PRIVATE_KEYor--key(PEM literal/file path).keygensubcommand writes keypair (private chmod 0600). 23 tests, 95% file coverage.Test plan
pytest tests/test_sign_manifest.py— 23 passruff check .clean