Skip to content

Fix consent key path handling and nacl shim compatibility #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielpmadden merged 1 commit into from
Oct 24, 2025
Merged

Fix consent key path handling and nacl shim compatibility #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions nacl/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,18 @@
from .exceptions import BadSignatureError, CryptoError
from .signing import SignedMessage, SigningKey, VerifyKey

# Expose the ``exceptions`` module at the package level to match the
# ``pynacl`` import style used by the application code (``from nacl import
# exceptions``). Our lightweight shim previously only re-exported the
# classes, which meant importing the module itself failed with
# ``ImportError`` when the real dependency was not installed.
from . import exceptions as exceptions # noqa: E402 (re-export for compatibility)

__all__ = [
"BadSignatureError",
"CryptoError",
"SignedMessage",
"SigningKey",
"VerifyKey",
"exceptions",
]
23 changes: 2 additions & 21 deletions reconscript/consent.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,7 @@
from nacl.signing import SigningKey, VerifyKey

SCHEMA_PATH = Path(__file__).resolve().parent / "schemas" / "scope_manifest.v1.json"
<<<<<<< HEAD
DEV_KEYS_DIR = Path(__file__).resolve().parents[1] / "keys"
=======
DEFAULT_PUBLIC_KEY = Path(
os.environ.get("CONSENT_PUBLIC_KEY_PATH", "keys/dev_ed25519.pub")
)
DEFAULT_PRIVATE_KEY = Path(
os.environ.get("REPORT_SIGNING_KEY_PATH", "keys/dev_ed25519.priv")
)
>>>>>>> 74be2f0 (style: fix reporters.py syntax and apply Black formatting)


class ConsentError(ValueError):
Expand Down Expand Up @@ -169,15 +160,10 @@ def load_manifest(path: Path | str) -> ConsentManifest:
return manifest


<<<<<<< HEAD
def validate_manifest(manifest: ConsentManifest, *, public_key_path: Optional[Path] = None) -> ConsentValidationResult:
key_path = _resolve_key_path(public_key_path, "CONSENT_PUBLIC_KEY_PATH")
=======
def validate_manifest(
manifest: ConsentManifest, *, public_key_path: Optional[Path] = None
) -> ConsentValidationResult:
key_path = public_key_path or DEFAULT_PUBLIC_KEY
>>>>>>> 74be2f0 (style: fix reporters.py syntax and apply Black formatting)
key_path = _resolve_key_path(public_key_path, "CONSENT_PUBLIC_KEY_PATH")
verify_key = _load_public_key(key_path)

body = {
Expand Down Expand Up @@ -214,15 +200,10 @@ def validate_manifest(
return ConsentValidationResult(manifest=manifest, verify_key=verify_key)


<<<<<<< HEAD
def sign_report_hash(report_hash: str, *, private_key_path: Optional[Path] = None) -> bytes:
key_path = _resolve_key_path(private_key_path, "REPORT_SIGNING_KEY_PATH")
=======
def sign_report_hash(
report_hash: str, *, private_key_path: Optional[Path] = None
) -> bytes:
key_path = private_key_path or DEFAULT_PRIVATE_KEY
>>>>>>> 74be2f0 (style: fix reporters.py syntax and apply Black formatting)
key_path = _resolve_key_path(private_key_path, "REPORT_SIGNING_KEY_PATH")
signing_key = _load_private_key(key_path)
message = report_hash.encode("utf-8")
signed = signing_key.sign(message)
Expand Down
Loading