securesystemslib

import os import json from securesystemslib.signer import CryptoSigner, Key from securesystemslib.formats import encode_canonical_json # 1. Generate a new key pair using the CryptoSigner (e.g., RSA) # In a real scenario, you'd protect the private key with a strong password # or use a KMS. For quickstart, we'll use a placeholder password. # Create a temporary directory for keys if not os.path.exists("temp_keys"): os.makedirs("temp_keys") passphrase = os.environ.get('SECURESYSTEMSLIB_PASSPHRASE', 'secret-password') # Generate an RSA key pair private_key_path = os.path.join("temp_keys", "example_key") signer = CryptoSigner.generate_and_write_key(private_key_path, keytype="rsa", algorithm="rsassa-pss-sha256", passphrase=passphrase) # The public key details are part of the signer object public_key = signer.public_key print(f"Generated public key ID: {public_key.keyid}") # 2. Prepare some data to sign data_to_sign = {"message": "Hello, securesystemslib!", "timestamp": 1678886400} canonical_data = encode_canonical_json(data_to_sign).encode("utf-8") # 3. Sign the data signature = signer.sign(canonical_data) print(f"Generated signature: {signature.signature[:20]}...") # 4. Verify the signature # A Key object can be created from the public_key dictionary verifier_key = Key.from_dict(public_key.keyid, public_key.to_dict()) # Verify using the signer and the original data try: CryptoSigner.verify_signature(signature, verifier_key, canonical_data) print("Signature verification successful!") except Exception as e: print(f"Signature verification failed: {e}") # Clean up temporary files (optional) os.remove(private_key_path) os.remove(private_key_path + ".pub") os.rmdir("temp_keys")