Metadata-Version: 2.5
Name: sign-and-verify
Version: 1.0.0
Summary: Sign-and-Verify: SAVSigner (KERI AID, FAW/Dossier issuance, signature validation) and SAVVerifier (Dossier crypto verification + revocation checking), built on keripy
Requires-Python: >=3.12.2
Requires-Dist: blake3>=0.4.1
Requires-Dist: keri<1.3,>=1.2
Requires-Dist: requests>=2.31.0
Description-Content-Type: text/markdown

# sign-and-verify

Python library implementing the Sign-and-Verify methodology (see
[methodology.md](methodology.md)): `SAVSigner` (owns a KERI AID, issues Foreign Artifact
Wrapper and Dossier credentials, validates external AIDs' signatures) and `SAVVerifier`
(cryptographically verifies a presented Dossier CESR stream).

## Setup

1. Install dependencies: `uv sync --group dev`
2. Run the test suite (no network/witness pool required): `uv run pytest`
3. To actually issue credentials against a real keystore:
   - Start a `kli` witness demo pool and a vlei-server serving the FAW/Dossier schemas
     (see the `vLEI` repo's `schema/acdc/foreign-artifact-wrapper.json` and
     `schema/acdc/dossier.json` — these must be saidified and published first).
   - Run `scripts/incept-signer-aid.sh` once (with `SIGNER_NAME`, `SIGNER_BASE`,
     `SIGNER_ALIAS`, `SIGNER_PASS` set) to incept the signer's AID and its two
     credential registries.
   - See `examples/basic_usage.py`.
4. To verify a presented Dossier CESR stream (built via `export_credential`, see below):
   `SAVVerifier(VerifierConfig(...)).verify_presentation(cesr, said)` — a fresh, throwaway local
   KERI store; a verifier controls no AID and issues nothing, so `VerifierConfig` needs only
   `schema_oobis` beyond the keystore location.

## Package layout

- `src/sign_and_verify/signer.py` — `SAVSigner`, the issuance-side public facade.
- `src/sign_and_verify/verifying.py` — `SAVVerifier`: `verify_presentation()` (crypto validity via
  keripy's `Parser`/`Verifier`) and `check_revocation()` (direct witness TEL query; does not
  cryptographically verify the revocation event itself — see its docstring for why that's an
  intentional, precedented choice).
- `src/sign_and_verify/utils.py` — `export_credential()`: serializes a credential's full CESR
  proof (KEL + TEL + chained edge credentials, recursively, each edge fully introduced *before*
  anything that references it + the credential's own ACDC last) into one presentable stream.
- `src/sign_and_verify/environment.py`, `verifier_environment.py` — open an existing signer/verifier
  keystore (never incepts an AID).
- `src/sign_and_verify/doers.py`, `issuance.py`, `resolvers.py`, `validation.py` — supporting
  modules for the issue-and-wait pattern, schema/OOBI resolution, and signature validation.
- `src/sign_and_verify/config.py`, `verifier_config.py`, `errors.py` — settings and error types.
- `scripts/` — kli-based AID/registry inception tooling.
