dulwich.signature.SSHSigSignatureVendor

class documentation

class SSHSigSignatureVendor(SignatureVerifier):

Constructors: SSHSigSignatureVendor.from_config(config, keyids), SSHSigSignatureVendor(allowed_signers_file, revocation_file, default_key_command, keyids)

View In Hierarchy

Signature verifier that uses the sshsig Python package for SSH signature verification.

Note: This vendor only supports verification, not signing. The sshsig package does not provide signing functionality. For signing, use SSHCliSignatureVendor.

Supports git config options: - gpg.ssh.allowedSignersFile: File containing allowed SSH public keys - gpg.ssh.revocationFile: File containing revoked SSH public keys - gpg.ssh.defaultKeyCommand: Command to get default SSH key (currently unused)

For SSH signatures, keyids are interpreted as principals (identities) like "[email protected]", consistent with Git's SSH signature model. When keyids are provided, the allowed_signers_file must also be configured, and only signatures from keys associated with those principals will be trusted.

Security features: - Key lifetime validation: Checks valid-after and valid-before options in allowed_signers - Revocation checking: Verifies keys against revocation file if configured

Class Method	`available`	Check if the sshsig Python package is available.
Class Method	`from_config`	Create an SSH signature verifier from git configuration.
Method	`__init__`	Initialize the SSH signature verifier.
Method	`verify`	Verify an SSH signature using the sshsig package.
Instance Variable	`allowed_signers_file`	Undocumented
Instance Variable	`default_key_command`	Undocumented
Instance Variable	`revocation_file`	Undocumented
Method	`_check_key_lifetime`	Check if a key is within its valid lifetime.
Method	`_check_not_revoked`	Check if a key has been revoked.
Method	`_load_allowed_signers_file`	Load and parse an allowed_signers file.
Method	`_load_revoked_keys`	Load revoked SSH public keys from a revocation file.
Method	`_parse_ssh_timestamp`	Parse SSH timestamp format to Unix timestamp.
Method	`_principal_matches`	Check if a signer's principals match any of the allowed principals.
Method	`_signers_to_keys`	Convert AllowedSigner objects to PublicKey objects.

Inherited from SignatureVerifier:

Instance Variable keyids Undocumented

@classmethod

def available(cls) -> bool: ¶

overrides dulwich.signature.SignatureVerifier.available

Check if the sshsig Python package is available.

Returns
`bool`	True if sshsig package can be imported, False otherwise

@classmethod

def from_config(cls, config: Config | None = None, keyids: Iterable[str] | None = None) -> SSHSigSignatureVendor: ¶

Create an SSH signature verifier from git configuration.

Parameters
config:`Config \| None`	Git configuration to read settings from
keyids:`Iterable[str] \| None`	Optional iterable of trusted SSH key fingerprints for verification

Returns
`SSHSigSignatureVendor`	SSHSigSignatureVendor instance configured from the config

def __init__(self, allowed_signers_file: str | None = None, revocation_file: str | None = None, default_key_command: str | None = None, keyids: Iterable[str] | None = None): ¶

overrides dulwich.signature.SignatureVerifier.__init__

Initialize the SSH signature verifier.

Parameters
allowed_signers_file:`str \| None`	Path to allowed signers file
revocation_file:`str \| None`	Path to file containing revoked SSH public keys
default_key_command:`str \| None`	Command to get default SSH key (currently unused)
keyids:`Iterable[str] \| None`	Optional iterable of trusted principals (identities) like "[email protected]". If provided, requires allowed_signers_file to be configured. Only signatures from keys associated with these principals will be trusted. This matches Git's -I flag in ssh-keygen -Y verify.

def verify(self, data: bytes, signature: bytes): ¶

overrides dulwich.signature.SignatureVerifier.verify

Verify an SSH signature using the sshsig package.

Note

For SSH signatures, keyids are interpreted as principals (identities) like "[email protected]", consistent with Git's SSH signature model. When keyids are provided, only signatures from keys associated with those principals (or wildcard "*" principals) will be trusted.

Parameters
data:`bytes`	The data that was signed
signature:`bytes`	The SSH signature to verify (armored format)

Raises
`UntrustedSignature`	if no allowed signers are configured or if signature is not from a trusted principal
`BadSignature`	if signature verification fails

allowed_signers_file = ¶

Undocumented

default_key_command = ¶

Undocumented

revocation_file = ¶

Undocumented

def _check_key_lifetime(self, signer: sshsig.allowed_signers.AllowedSigner, current_time: int): ¶

Check if a key is within its valid lifetime.

Parameters
signer:`sshsig.allowed_signers.AllowedSigner`	AllowedSigner object with optional lifetime constraints
current_time:`int`	Current Unix timestamp to check against

Raises
`UntrustedSignature`	if key is not yet valid or has expired

def _check_not_revoked(self, key: sshsig.ssh_public_key.PublicKey, revoked_keys: list[sshsig.ssh_public_key.PublicKey]): ¶

Check if a key has been revoked.

Parameters
key:`sshsig.ssh_public_key.PublicKey`	PublicKey to check
revoked_keys:`list[sshsig.ssh_public_key.PublicKey]`	List of revoked PublicKey objects

Raises
`UntrustedSignature`	if the key has been revoked

def _load_allowed_signers_file(self, path: str) -> list[sshsig.allowed_signers.AllowedSigner]: ¶

Load and parse an allowed_signers file.

Parameters
path:`str`	Path to the allowed_signers file

Returns
`list[sshsig.allowed_signers.AllowedSigner]`	List of AllowedSigner objects

Raises
`UntrustedSignature`	if file not found or invalid format

def _load_revoked_keys(self, path: str) -> list[sshsig.ssh_public_key.PublicKey]: ¶

Load revoked SSH public keys from a revocation file.

The revocation file format is the same as authorized_keys: each line contains a public key in OpenSSH format.

Parameters
path:`str`	Path to the revocation file

Returns
`list[sshsig.ssh_public_key.PublicKey]`	List of revoked PublicKey objects

Raises
`UntrustedSignature`	if file cannot be read or contains invalid keys

def _parse_ssh_timestamp(self, timestamp_str: str) -> int: ¶

Parse SSH timestamp format to Unix timestamp.

Supports Git's SSH timestamp formats: - YYYYMMDD[Z] - YYYYMMDDHHMM[SS][Z]

Parameters
timestamp_str:`str`	Timestamp string to parse

Returns
`int`	Unix timestamp (seconds since epoch)

Raises
`UntrustedSignature`	if timestamp format is invalid

def _principal_matches(self, signer_principals: str, allowed_principals: list[str]) -> bool: ¶

Check if a signer's principals match any of the allowed principals.

Parameters
signer_principals:`str`	Comma-separated principals from allowed_signers file (e.g., "[email protected],[email protected]" or "*")
allowed_principals:`list[str]`	List of principals to match against

Returns
`bool`	True if any signer principal matches any allowed principal, or if signer_principals is "*" (wildcard)

def _signers_to_keys(self, signers: list[sshsig.allowed_signers.AllowedSigner]) -> list[sshsig.ssh_public_key.PublicKey]: ¶

Convert AllowedSigner objects to PublicKey objects.

Parameters
signers:`list[sshsig.allowed_signers.AllowedSigner]`	List of AllowedSigner objects

Returns
`list[sshsig.ssh_public_key.PublicKey]`	List of PublicKey objects

Raises
`UntrustedSignature`	if any key cannot be parsed