dulwich.signature.SSHCliSignatureVendor

class documentation

class SSHCliSignatureVendor(SignatureSigner, SignatureVerifier):

Constructors: SSHCliSignatureVendor.from_config(config, keyids), SSHCliSignatureVendor(ssh_command, allowed_signers_file, revocation_file, default_key_command, ...)

View In Hierarchy

Signature vendor that uses ssh-keygen command-line tool for SSH signatures.

Supports git config options: - gpg.ssh.allowedSignersFile: File containing allowed SSH public keys - gpg.ssh.revocationFile: File containing revoked SSH public keys - gpg.ssh.program: Path to ssh-keygen command - gpg.ssh.defaultKeyCommand: Command to get default SSH key for signing

Class Method	`available`	Check if the ssh-keygen command is available.
Class Method	`from_config`	Create an SSH CLI vendor from git configuration.
Method	`__init__`	Initialize the SSH CLI vendor.
Method	`sign`	Sign data with an SSH key using ssh-keygen.
Method	`verify`	Verify an SSH signature using ssh-keygen.
Instance Variable	`allowed_signers_file`	Undocumented
Instance Variable	`default_key_command`	Undocumented
Instance Variable	`revocation_file`	Undocumented
Instance Variable	`ssh_command`	Undocumented

Inherited from SignatureVerifier (via SignatureSigner):

Instance Variable keyids Undocumented

@classmethod

def available(cls) -> bool: ¶

overrides dulwich.signature.SignatureSigner.available

Check if the ssh-keygen command is available.

Returns
`bool`	True if ssh-keygen command is in PATH, False otherwise

@classmethod

def from_config(cls, config: Config | None = None, keyids: Iterable[str] | None = None) -> SSHCliSignatureVendor: ¶

Create an SSH CLI vendor from git configuration.

Parameters
config:`Config \| None`	Git configuration to read settings from
keyids:`Iterable[str] \| None`	Optional iterable of trusted SSH key fingerprints for verification

Returns
`SSHCliSignatureVendor`	SSHCliSignatureVendor instance configured from the config

def __init__(self, ssh_command: str = 'ssh-keygen', allowed_signers_file: str | None = None, revocation_file: str | None = None, default_key_command: str | None = None, keyids: Iterable[str] | None = None): ¶

overrides dulwich.signature.SignatureVerifier.__init__

Initialize the SSH CLI vendor.

Parameters
ssh_command:`str`	Path to ssh-keygen command (default: "ssh-keygen")
allowed_signers_file:`str \| None`	Path to allowed signers file
revocation_file:`str \| None`	Path to revocation file
default_key_command:`str \| None`	Command to get default SSH key for signing
keyids:`Iterable[str] \| None`	Optional iterable of trusted SSH key fingerprints for verification. If provided, only signatures from these keys will be trusted.

def sign(self, data: bytes, keyid: str | None = None) -> bytes: ¶

overrides dulwich.signature.SignatureSigner.sign

Sign data with an SSH key using ssh-keygen.

Parameters
data:`bytes`	The data to sign
keyid:`str \| None`	Path to SSH private key. If not specified, will try to get default key from gpg.ssh.defaultKeyCommand

Returns
`bytes`	The signature as bytes

Raises
`subprocess.CalledProcessError`	if ssh-keygen command fails
`ValueError`	if keyid is not provided and no default key available

def verify(self, data: bytes, signature: bytes): ¶

overrides dulwich.signature.SignatureVerifier.verify

Verify an SSH signature using ssh-keygen.

Parameters
data:`bytes`	The data that was signed
signature:`bytes`	The signature to verify

Raises
`BadSignature`	if signature verification fails
`UntrustedSignature`	if allowedSignersFile is not configured

allowed_signers_file = ¶

Undocumented

default_key_command = ¶

Undocumented

revocation_file = ¶

Undocumented

ssh_command = ¶

Undocumented