dulwich.signature

module documentation

Signature vendors for signing and verifying Git objects.

Class	`GPGCliSignatureVendor`	Signature vendor that uses the GPG command-line tool for signing and verification.
Class	`GPGSignatureVendor`	Signature vendor that uses the GPG package for signing and verification.
Class	`SignatureSigner`	A signature implementation for signing Git objects.
Class	`SignatureVerifier`	A signature implementation for verifying Git objects.
Class	`SSHCliSignatureVendor`	Signature vendor that uses ssh-keygen command-line tool for SSH signatures.
Class	`SSHSigSignatureVendor`	Signature verifier that uses the sshsig Python package for SSH signature verification.
Class	`X509SignatureVendor`	Signature vendor that uses gpgsm (GnuPG for S/MIME) for X.509 signatures.
Exception	`BadSignature`	Exception raised when a signature is invalid or cannot be verified.
Exception	`SignatureVerificationError`	Base exception for signature verification failures.
Exception	`UntrustedSignature`	Exception raised when a signature is not from a trusted key.
Function	`detect_signature_format`	Detect the signature format from the signature data.
Function	`get_available_vendors`	Get all available signature vendors on this system.
Function	`get_signature_vendor`	Get a signature signer for the specified format.
Function	`get_signature_vendor_for_signature`	Get the appropriate signature vendor for a given signature.
Constant	`SIGNATURE_FORMAT_OPENPGP`	Undocumented
Constant	`SIGNATURE_FORMAT_SSH`	Undocumented
Constant	`SIGNATURE_FORMAT_X509`	Undocumented
Variable	`gpg_vendor`	Undocumented

def detect_signature_format(signature: bytes) -> str: ¶

Detect the signature format from the signature data.

Git signatures are always in ASCII-armored format.

Parameters
signature:`bytes`	The signature bytes

Returns
`str`	Signature format constant (SIGNATURE_FORMAT_OPENPGP, SIGNATURE_FORMAT_SSH, etc.)

Raises
`ValueError`	if signature format cannot be detected

def get_available_vendors() -> dict[str, list[type[SignatureSigner] | type[SignatureVerifier]]]: ¶

Get all available signature vendors on this system.

Returns a dictionary mapping signature format names to lists of available vendor classes for each format. Only vendors whose dependencies are available are included.

Example

>>> vendors = get_available_vendors()
>>> if "openpgp" in vendors:
...     print(f"GPG vendors: {vendors['openpgp']}")
>>> if "ssh" in vendors:
...     print(f"SSH vendors: {vendors['ssh']}")

Returns
`dict[str, list[type[SignatureSigner] \| type[SignatureVerifier]]]`	Dictionary mapping format names (e.g. "openpgp", "ssh", "x509") to lists of available vendor classes. If no vendors are available for a format, that format will not be present in the dictionary.

def get_signature_vendor(format: str | None = None, config: Config | None = None) -> SignatureSigner: ¶

Get a signature signer for the specified format.

Parameters
format:`str \| None`	Signature format. If None, reads from config's gpg.format setting. Supported values: - "openpgp": Use OpenPGP/GPG signatures (default) - "x509": Use X.509 signatures - "ssh": Use SSH signatures
config:`Config \| None`	Optional Git configuration

Returns
`SignatureSigner`	Signature signer instance for the requested format

Raises
`ValueError`	if the format is not supported

def get_signature_vendor_for_signature(signature: bytes, config: Config | None = None, keyids: Iterable[str] | None = None) -> SignatureVerifier: ¶

Get the appropriate signature vendor for a given signature.

This function detects the signature format and returns the appropriate vendor to verify it.

Parameters
signature:`bytes`	The signature bytes to detect format from
config:`Config \| None`	Optional Git configuration
keyids:`Iterable[str] \| None`	Optional iterable of trusted key IDs for verification. If provided, only signatures from these keys will be trusted.

Returns
`SignatureVerifier`	Signature vendor instance appropriate for the signature format

Raises
`ValueError`	if signature format cannot be detected or is not supported

SIGNATURE_FORMAT_OPENPGP: str = ¶

Undocumented

Value

'openpgp'

SIGNATURE_FORMAT_SSH: str = ¶

Undocumented

Value

'ssh'

SIGNATURE_FORMAT_X509: str = ¶

Undocumented

Value

'x509'

gpg_vendor = ¶

Undocumented