signedjson

library1.1.4pypypi✓ verified 85d ago

Library for signing JSON objects with Ed25519 signatures and verifying them. Version 1.1.4, stable but developed sporadically.

auth-security serialization

pip install signedjson

package ↗

INSTALL

IMPORT

SIG · SIGNEDJSON

signedjson

auth-securitypythonv1.1.4

Install

2.1s avg

Import

137ms

Disk

22MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v1.1.4 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.140s · 23.4MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 2.1s · import 0.134s · 24MB

22MB installed

● package 22MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sign_json

✓ from signedjson.sign import sign_json

✗ from signedjson import sign_json

sign_json is not exposed at package level; import from submodule

verify_signed_json

✓ from signedjson.sign import verify_signed_json

✗ from signedjson import verify_signed_json

Same as above: must import from submodule

encode_canonical_json

✓ from signedjson.canonical import encode_canonical_json

✗ from signedjson import encode_canonical_json

Canonical encoding is in its own submodule

KEY_LEN

✓ from signedjson.key import KEY_LEN

✗ from signedjson import KEY_LEN

Key constants are in the key submodule

Basic signing and verification with Ed25519.

import os from signedjson.key import generate_signing_key, write_signing_keys from signedjson.sign import sign_json, verify_signed_json # Generate a key pair (Ed25519) key = generate_signing_key('mykey') # Sign a JSON object json_obj = {"hello": "world"} signed = sign_json(json_obj, key) print("Signed:", signed) # Verify with the same key verified = verify_signed_json(signed, key.alg, key.version) assert verified == json_obj # Write keys to a file (optional) write_signing_keys([key], 'keys.txt') # Read back: read_signing_keys opens the file

Debug

Known issues

gotchaSigning keys are Ed25519, not RSA or ECDSA. Do not attempt to use other key types.

fix

Use generate_signing_key() to create Ed25519 keys.

affects: all

gotchaverify_signed_json() expects the key's algorithm (e.g., 'ed25519') and version, not the full key object. Passing the key object directly will fail.

fix

Call verify_signed_json(signed_json, key.alg, key.version) where key is a SigningKey or VerifyKey.

affects: all

gotchaThe library encodes JSON in a canonical form (sorted keys, no whitespace). Signatures are over the canonical bytes, not the original object.

fix

Always pass a Python dict (or JSON-serializable object) to sign_json; it will canonicalize automatically.

affects: all

breakingVersion 1.0 dropped Python 2 support and removed deprecated decode_canonical_json.

fix

Upgrade to Python 3. Use json.loads() if you need the decoded JSON.

affects: >=1.0

Errors

Common errors & fixes

AttributeError: module 'signedjson' has no attribute 'sign_json'

Importing from top-level package instead of submodule.

fix

Use: from signedjson.sign import sign_json

TypeError: verify_signed_json() missing 2 required positional arguments: 'algorithm' and 'key_version'

Passing only the signed JSON and key object; missing key.alg and key.version.

fix

Call: verify_signed_json(signed_json, key.alg, key.version)

signedjson.key.InvalidSigningKeyError: Algorithm not supported: rsa

Attempting to sign with an RSA key or incorrect algorithm string.

fix

Only Ed25519 keys are supported. Use generate_signing_key() to create a valid key.

Upgrade

Version history

1.1.4latest on PyPI · released Mar 29, 2022

Audit

Dependencies

PyNaClrequiredEd25519 signing uses libsodium via PyNaCl

canonicaljsonrequiredEnsures canonical JSON encoding for consistent signatures

Agent activity

29 hits · last 30 days

node

OpenAI (training)

Resources

packagehttps://pypi.org/project/signedjson/ ↗