1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
Metadata-Version: 2.4
Name: securesystemslib
Version: 1.3.0
Summary: A library that provides cryptographic and general-purpose routines for Secure Systems Lab projects at NYU
Project-URL: Homepage, https://github.com/secure-systems-lab/securesystemslib
Project-URL: Source, https://github.com/secure-systems-lab/securesystemslib
Project-URL: Issues, https://github.com/secure-systems-lab/securesystemslib/issues
Author-email: "https://www.updateframework.com" <theupdateframework@googlegroups.com>
License-Expression: MIT
License-File: LICENSE
Keywords: cryptography,ecdsa,ed25519,keys,rsa,signatures
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Natural Language :: English
Classifier: Operating System :: MacOS :: MacOS X
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: POSIX
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: Implementation :: CPython
Classifier: Topic :: Security
Classifier: Topic :: Software Development
Requires-Python: ~=3.8
Provides-Extra: awskms
Requires-Dist: boto3; extra == 'awskms'
Requires-Dist: botocore; extra == 'awskms'
Requires-Dist: cryptography>=40.0.0; extra == 'awskms'
Provides-Extra: azurekms
Requires-Dist: azure-identity; extra == 'azurekms'
Requires-Dist: azure-keyvault-keys; extra == 'azurekms'
Requires-Dist: cryptography>=40.0.0; extra == 'azurekms'
Provides-Extra: crypto
Requires-Dist: cryptography>=40.0.0; extra == 'crypto'
Provides-Extra: gcpkms
Requires-Dist: cryptography>=40.0.0; extra == 'gcpkms'
Requires-Dist: google-cloud-kms; extra == 'gcpkms'
Provides-Extra: hsm
Requires-Dist: asn1crypto; extra == 'hsm'
Requires-Dist: cryptography>=40.0.0; extra == 'hsm'
Requires-Dist: pykcs11; extra == 'hsm'
Provides-Extra: pyspx
Requires-Dist: pyspx>=0.5.0; extra == 'pyspx'
Provides-Extra: sigstore
Requires-Dist: sigstore~=3.0; extra == 'sigstore'
Provides-Extra: vault
Requires-Dist: cryptography>=40.0.0; extra == 'vault'
Requires-Dist: hvac; extra == 'vault'
Description-Content-Type: text/markdown
# securesystemslib
[](https://github.com/secure-systems-lab/securesystemslib/actions?query=workflow%3A%22Run+Securesystemslib+tests%22+branch%3Amain)
[](https://python-securesystemslib.readthedocs.io/en/latest/?badge=latest)
Securesystemslib is a cryptography interface for signing and verifying digital
signatures. It is developed for the [TUF](https://theupdateframework.io) and
[in-toto](https://in-toto.io) projects: the key and signature containers are
compatible with metadata formats from those projects.
Under the hood, Securesystemslib can use various digital signing systems
(e.g. [cryptography](https://pypi.org/project/cryptography/), PIV hardware keys
and multiple cloud-based key management systems).
## Installation
The default installation supports [pure-Python `ed25519` signature
verification](https://github.com/pyca/ed25519) only. To enable other schemes and
signature creation, `securesystemslib` can be installed with *extras*. See
[pyproject.toml](pyproject.toml) for available *optional dependencies*.
```bash
# Install with ed25519, RSA, ECDSA sign and verify support
pip install securesystemslib[crypto]
```
```bash
# ...or with HSM (e.g. Yubikey) support
pip install securesystemslib[hsm]
```
## Usage
[python-securesystemslib.readthedocs.io](https://python-securesystemslib.readthedocs.io)
## Contact
- Questions and discussions:
[`#securesystemslib-python`](https://cloud-native.slack.com/archives/C05PF3GA7AL)
on [CNCF Slack](https://communityinviter.com/apps/cloud-native/cncf)
- Security issues: see [Security policy](docs/SECURITY.md)
- Other issues and requests: [*Open a new
issue*](https://github.com/secure-systems-lab/securesystemslib/issues/new)
## Contribute
See [Instructions for contributors](docs/CONTRIBUTING.md).
## Legacy key migration
Use
[`migrate_keys`](https://github.com/secure-systems-lab/securesystemslib/blob/v0.31.0/docs/migrate_key.py)
script to convert key pairs generated with legacy `keys` or `interface` modules
to a consistent standard format, which is compatible with
[`CryptoSigner`](docs/CRYPTO_SIGNER.md). The script requires
`securesystemslib~=0.31.0`.
|
