Using OpenChainGraph with Ed25519

# PAE(type, body) = "DSSEv1" + SP + LEN(type) + SP + type + SP + LEN(body) + SP + body
# Where LEN is the ASCII decimal byte length, SP is a single space (0x20)

payloadType = "application/vnd.openchain.graph+json;version=0.2"
payload     = base64url_decode(audit_signature.payload)

pae = (
  "DSSEv1"
  + " " + str(len(payloadType.encode()))
  + " " + payloadType
  + " " + str(len(payload))
  + " "
).encode() + payload

# Ed25519.sign(privateKey, pae) → 64-byte signature → base64url → sig field
# Ed25519.verify(publicKey, pae, base64url_decode(sig)) → bool

// Generate a non-extractable Ed25519 key pair in the browser.
// The private key never leaves the WebCrypto key store.
const keyPair = await crypto.subtle.generateKey(
  { name: "Ed25519" },
  false,         // extractable = false — private key stays in the engine
  ["sign", "verify"]
);

// Export the public key as raw bytes (32 bytes) for distribution
const pubRaw     = await crypto.subtle.exportKey("raw", keyPair.publicKey);
const pubB64url  = btoa(String.fromCharCode(...new Uint8Array(pubRaw)))
                    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");

// Compute keyid: first 8 bytes of SHA-256(pubRaw) → lowercase hex
const hashBuf = await crypto.subtle.digest("SHA-256", pubRaw);
const keyid   = Array.from(new Uint8Array(hashBuf).slice(0, 8))
                  .map(b => b.toString(16).padStart(2, "0")).join("");

console.log("Public key (base64url):", pubB64url);
console.log("keyid:", keyid);

// Store keyPair.privateKey in memory; import it back via importKey() in future sessions.

from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.hazmat.primitives.serialization import (
    Encoding, PrivateFormat, PublicFormat, NoEncryption
)
import hashlib, base64

# Generate private key
private_key = Ed25519PrivateKey.generate()

# Export private key as raw bytes (32 bytes) — store encrypted at rest
priv_raw = private_key.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption())

# Export public key as raw bytes (32 bytes) — safe to publish
pub_raw  = private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
pub_b64url = base64.urlsafe_b64encode(pub_raw).rstrip(b"=").decode()

# Compute keyid: first 8 bytes of SHA-256(pub_raw) → lowercase hex
keyid = hashlib.sha256(pub_raw).digest()[:8].hex()

print(f"Public key (base64url): {pub_b64url}")
print(f"keyid:                  {keyid}")

# Write priv_raw to a secrets vault or environment variable, NEVER to a file in the repo.

# Generate key pair; cosign will prompt for a password to encrypt the private key
cosign generate-key-pair --output-key-prefix ocg-signing

# This produces:
#   ocg-signing.key      — encrypted PEM private key  (protect this)
#   ocg-signing.pub      — PEM public key             (publish this)

# Export the raw public key bytes for the OCG keyid computation
openssl pkey -in ocg-signing.pub -pubin -outform DER | tail -c 32 | xxd -p | tr -d '\n' | cut -c1-16
# → first 8 bytes of DER-encoded pub key (= first 8 bytes of raw public key bytes)

# Or: compute keyid from the PEM public key directly
openssl pkey -in ocg-signing.pub -pubin -outform DER \
  | sha256sum | cut -c1-16
# Prefix matches what WebCrypto and Python cryptography produce for the same key.

/**
 * signOcgArtifact(artifact, privateKey, keyid)
 *   artifact   — the completed OCG artifact object (must have execution_hash)
 *   privateKey — WebCrypto CryptoKey (Ed25519, usage: ["sign"])
 *   keyid      — string identifying this key (see §2)
 *
 * Returns the artifact with audit_signature fully populated.
 */
async function signOcgArtifact(artifact, privateKey, keyid) {
  const PAYLOAD_TYPE = "application/vnd.openchain.graph+json;version=0.2";

  // 1. Build the payload object: only the fields that contribute to execution_hash
  const payloadObj = {
    tool_id:          artifact.tool_id,
    execution_hash:   artifact.execution_hash,
    policy_parameters: sortKeysDeep(artifact.policy_parameters),
    output_payload:   sortKeysDeep(artifact.output_payload),
    mandate_type:     artifact.mandate_type,
    timestamp:        artifact.timestamp
  };
  const payloadBytes = new TextEncoder().encode(JSON.stringify(payloadObj));
  const payloadB64   = bytesToBase64url(payloadBytes);

  // 2. Build the DSSE PAE bytes
  const typeBytes = new TextEncoder().encode(PAYLOAD_TYPE);
  const pae = concat(
    new TextEncoder().encode("DSSEv1 "
      + typeBytes.length + " " + PAYLOAD_TYPE + " "
      + payloadBytes.length + " "),
    payloadBytes
  );

  // 3. Sign with Ed25519
  const sigBytes = await crypto.subtle.sign("Ed25519", privateKey, pae);
  const sigB64   = bytesToBase64url(new Uint8Array(sigBytes));

  // 4. Attach envelope to the artifact
  artifact.audit_signature = {
    payloadType: PAYLOAD_TYPE,
    payload:     payloadB64,
    signatures:  [{ keyid, sig: sigB64 }]
  };

  return artifact;
}

// Helper: recursively sort object keys (needed for payload determinism)
function sortKeysDeep(obj) {
  if (Array.isArray(obj)) return obj.map(sortKeysDeep);
  if (obj === null || typeof obj !== "object") return obj;
  return Object.fromEntries(
    Object.keys(obj).sort().map(k => [k, sortKeysDeep(obj[k])])
  );
}

// Helper: Uint8Array → base64url string (no padding)
function bytesToBase64url(bytes) {
  return btoa(String.fromCharCode(...bytes))
    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
}

// Helper: concat two Uint8Arrays
function concat(a, b) {
  const r = new Uint8Array(a.length + b.length);
  r.set(a); r.set(b, a.length); return r;
}

/**
 * verifyOcgSignature(artifact, publicKeyB64url)
 *   artifact       — the OCG artifact object (v0.3, with audit_signature)
 *   publicKeyB64url — base64url-encoded 32-byte Ed25519 public key
 *
 * Returns { valid: bool, keyid: string, error?: string }
 */
async function verifyOcgSignature(artifact, publicKeyB64url) {
  const env = artifact.audit_signature;
  if (!env || typeof env !== "object") {
    return { valid: false, error: "No audit_signature object (v0.1 artifact?)" };
  }

  const PAYLOAD_TYPE = "application/vnd.openchain.graph+json;version=0.2";
  if (env.payloadType !== PAYLOAD_TYPE) {
    return { valid: false, error: "Unexpected payloadType: " + env.payloadType };
  }

  // 1. Decode payload bytes from the envelope
  const payloadBytes = base64urlToBytes(env.payload);

  // 2. Reconstruct PAE
  const typeBytes = new TextEncoder().encode(PAYLOAD_TYPE);
  const pae = concat(
    new TextEncoder().encode("DSSEv1 "
      + typeBytes.length + " " + PAYLOAD_TYPE + " "
      + payloadBytes.length + " "),
    payloadBytes
  );

  // 3. Import the public key
  const pubRaw = base64urlToBytes(publicKeyB64url);
  const pubKey = await crypto.subtle.importKey(
    "raw", pubRaw, { name: "Ed25519" }, false, ["verify"]
  );

  // 4. Verify each signature entry
  const results = await Promise.all(
    (env.signatures || []).map(async entry => {
      const sigBytes = base64urlToBytes(entry.sig);
      const ok = await crypto.subtle.verify("Ed25519", pubKey, sigBytes, pae);
      return { keyid: entry.keyid, sigValid: ok };
    })
  );

  // 5. Cross-check: re-derive payload from artifact fields and compare
  const rePayload = JSON.stringify({
    tool_id:          artifact.tool_id,
    execution_hash:   artifact.execution_hash,
    policy_parameters: sortKeysDeep(artifact.policy_parameters),
    output_payload:   sortKeysDeep(artifact.output_payload),
    mandate_type:     artifact.mandate_type,
    timestamp:        artifact.timestamp
  });
  const rePayloadBytes = new TextEncoder().encode(rePayload);
  const payloadMatch   = rePayload === new TextDecoder().decode(payloadBytes);

  const sigValid = results.some(r => r.sigValid);
  return {
    valid:        sigValid && payloadMatch,
    sigValid,
    payloadMatch,
    signatures:   results,
    keyid:        results.find(r => r.sigValid)?.keyid ?? null
  };
}

// Helper: base64url string → Uint8Array
function base64urlToBytes(b64url) {
  const b64 = b64url.replace(/-/g, "+").replace(/_/g, "/");
  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
  return Uint8Array.from(atob(padded), c => c.charCodeAt(0));
}

import base64, json, hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.exceptions import InvalidSignature

def sort_keys_deep(obj):
    """Recursively sort dict keys — must match OCG payload construction."""
    if isinstance(obj, dict):
        return {k: sort_keys_deep(obj[k]) for k in sorted(obj)}
    if isinstance(obj, list):
        return [sort_keys_deep(i) for i in obj]
    return obj

def b64url_decode(s):
    s = s.replace("-", "+").replace("_", "/")
    return base64.b64decode(s + "=" * ((4 - len(s) % 4) % 4))

def verify_ocg_signature(artifact: dict, public_key_b64url: str) -> dict:
    """
    Verify an OCG v0.3 audit_signature envelope.

    Returns a dict:
      valid        — True only if sig AND payload both check out
      sig_valid    — True if at least one signatures[] entry verified
      payload_match— True if the envelope payload matches re-derived artifact fields
      error        — error message if invalid, else None
    """
    PAYLOAD_TYPE = "application/vnd.openchain.graph+json;version=0.2"
    env = artifact.get("audit_signature")

    if not isinstance(env, dict):
        return {"valid": False, "error": "No audit_signature object (v0.1 artifact?)"}

    if env.get("payloadType") != PAYLOAD_TYPE:
        return {"valid": False, "error": f"Unexpected payloadType: {env.get('payloadType')}"}

    # 1. Decode envelope payload
    payload_bytes = b64url_decode(env["payload"])

    # 2. Build PAE
    type_bytes = PAYLOAD_TYPE.encode()
    pae = (
        f"DSSEv1 {len(type_bytes)} {PAYLOAD_TYPE} {len(payload_bytes)} ".encode()
        + payload_bytes
    )

    # 3. Load public key from raw bytes
    pub_raw = b64url_decode(public_key_b64url)
    pub_key = Ed25519PublicKey.from_public_bytes(pub_raw)

    # 4. Verify each signature entry
    sig_valid = False
    for entry in env.get("signatures", []):
        sig_bytes = b64url_decode(entry["sig"])
        try:
            pub_key.verify(sig_bytes, pae)
            sig_valid = True
        except InvalidSignature:
            pass

    # 5. Cross-check: re-derive payload from artifact fields
    re_payload_obj = {
        "execution_hash":    artifact["execution_hash"],
        "mandate_type":      artifact.get("mandate_type"),
        "output_payload":    sort_keys_deep(artifact.get("output_payload", {})),
        "policy_parameters": sort_keys_deep(artifact.get("policy_parameters", {})),
        "timestamp":         artifact.get("timestamp"),
        "tool_id":           artifact["tool_id"],
    }
    re_payload_bytes = json.dumps(re_payload_obj, separators=(",", ":")).encode()
    payload_match = re_payload_bytes == payload_bytes

    return {
        "valid":         sig_valid and payload_match,
        "sig_valid":     sig_valid,
        "payload_match": payload_match,
        "error":         None if (sig_valid and payload_match) else "Signature or payload mismatch"
    }

# Usage:
# with open("artifact.json") as f:
#     artifact = json.load(f)
# result = verify_ocg_signature(artifact, "base64url_encoded_public_key_here")
# assert result["valid"], result["error"]

async function coSignOcgArtifact(artifact, secondPrivateKey, secondKeyid) {
  const env = artifact.audit_signature;
  if (!env?.signatures) throw new Error("No existing envelope to co-sign");

  // Reconstruct the same PAE that the first signer used
  const PAYLOAD_TYPE = "application/vnd.openchain.graph+json;version=0.2";
  const payloadBytes = base64urlToBytes(env.payload);
  const typeBytes    = new TextEncoder().encode(PAYLOAD_TYPE);
  const pae = concat(
    new TextEncoder().encode("DSSEv1 "
      + typeBytes.length + " " + PAYLOAD_TYPE + " "
      + payloadBytes.length + " "),
    payloadBytes
  );

  // Sign and push new entry
  const sigBytes = await crypto.subtle.sign("Ed25519", secondPrivateKey, pae);
  env.signatures.push({
    keyid: secondKeyid,
    sig:   bytesToBase64url(new Uint8Array(sigBytes))
  });

  return artifact;  // audit_signature.signatures[] now has 2 entries
}

// Verification: check that BOTH keyids signed the same payload
async function verifyDualControl(artifact, publicKeys) {
  // publicKeys: { [keyid]: base64urlPublicKey }
  const results = await Promise.all(
    Object.entries(publicKeys).map(([kid, pub]) =>
      verifyOcgSignature(artifact, pub).then(r => ({ ...r, expectedKeyid: kid }))
    )
  );
  const allValid = results.every(r => r.valid);
  return { dualControlPassed: allValid, details: results };
}

{
  "@context":  "https://ainumbers.co/chaingraph/context/v0.3",
  "type":      "OcgKeyManifest",
  "publisher": "Post Oak Labs",
  "keys": [
    {
      "keyid":      "3f9a1b2c4d5e6f7a",
      "algorithm": "Ed25519",
      "public_key": "base64url_encoded_32_bytes",
      "status":    "active",
      "valid_from": "2026-01-01T00:00:00Z",
      "comment":  "OCG production signing key 2026-Q1"
    },
    {
      "keyid":      "8b7c2a1d9e4f3b6c",
      "algorithm": "Ed25519",
      "public_key": "base64url_encoded_32_bytes",
      "status":    "rotated",
      "valid_from": "2025-01-01T00:00:00Z",
      "rotated_at": "2026-01-01T00:00:00Z",
      "comment":  "OCG production signing key 2025 — rotated, public key retained for historical verification"
    }
  ]
}

# Keyless flow: Cosign generates an ephemeral Ed25519 key, uses Fulcio to issue
# a short-lived certificate binding the key to an OIDC identity (e.g. GitHub Actions OIDC),
# and submits the signature + cert chain to Rekor.

# 1. Sign the extracted OCG payload file (from Guide #3 §9)
cosign sign-blob \
  --bundle ocg-artifact.bundle \
  --identity-token "${OIDC_TOKEN}" \
  artifact-payload.json

# 2. Verify independently (auditor side) — no pre-shared key required
cosign verify-blob \
  --bundle ocg-artifact.bundle \
  --certificate-identity "[email protected]" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  artifact-payload.json

# 3. Record the Rekor UUID in your audit log alongside the artifact
#    rekor-cli get --uuid <uuid from bundle> → confirms timestamp + transparency