enterprise_ai.packs.sign

Source: sdks/python/src/enterprise_ai/packs/sign.py. Back to the Python SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Functions

generate_key_pair

generate_key_pair(directory: str | Path, password: str | None = None) -> tuple[Path, Path]

cosign generate-key-pair into directory: (cosign.key, cosign.pub).

Name	Type	Default	Required	Description
directory	str | Path		yes	Folder receiving the key pair, created when missing.
password	str | None	None	no	Password protecting the private key; default the COSIGN_PASSWORD environment variable.

Returns: tuple[Path, Path]. Tuple of the paths (cosign.key, cosign.pub).

sign_digest

sign_digest(digest: str, key: str | Path, password: str | None = None) -> str

Signature of the digest string, ready for the Marketplace (ecdsa-p256:<base64>).

Name	Type	Default	Required	Description
digest	str		yes	Digest string sha256:<hex> of the pack archive.
key	str | Path		yes	Path of the cosign private key.
password	str | None	None	no	Password of the key; default the COSIGN_PASSWORD environment variable.

Returns: str. Signature ecdsa-p256:<base64>; a cosign failure raises RuntimeError.

verify_digest

verify_digest(digest: str, signature: str, public_key: str | Path) -> bool

cosign verify-blob of a signature produced by :func:sign_digest.

Name	Type	Default	Required	Description
digest	str		yes	Digest string that was signed.
signature	str		yes	Signature, with or without the ecdsa-p256: prefix.
public_key	str | Path		yes	Path of the cosign public key.

Returns: bool. True when the signature matches the digest and the key, else False.