trestle.core.signing_manifest

def build_manifest_statement(
    manifest: SigningManifest, digest_algorithm: Algorithm = DEFAULT_DIGEST_ALGORITHM
) -> Dict[str, Any]:
    """Build the in-toto Statement payload for a signing manifest."""
    return {
        '_type': IN_TOTO_STATEMENT_TYPE,
        'subject': _manifest_subjects(manifest, digest_algorithm),
        'predicateType': PACKAGE_PREDICATE_TYPE,
        'predicate': {
            'tool': PACKAGE_TOOL,
            'manifestVersion': MANIFEST_VERSION,
            'primaryArtifact': manifest.primary_artifact,
            'artifacts': manifest.predicate_artifacts(),
        },
    }

def create_manifest_envelope(
    manifest: SigningManifest, signer: Signer, digest_algorithm: Algorithm = DEFAULT_DIGEST_ALGORITHM
) -> Dict[str, Any]:
    """Create a DSSE envelope for a validated signing manifest."""
    return sign_in_toto_statement(build_manifest_statement(manifest, digest_algorithm), signer)

def load_signing_manifest(manifest_path: pathlib.Path) -> SigningManifest:
    """Load and validate a JSON signing manifest."""
    manifest_path = manifest_path.resolve()
    if manifest_path.suffix.lower() != '.json':
        raise TrestleError(f'Signing manifest must be a JSON file: {manifest_path}')
    if not manifest_path.exists() or not manifest_path.is_file():
        raise TrestleError(f'Signing manifest path does not exist or is not a file: {manifest_path}')

    try:
        manifest_data, _ = load_canonical_json_file(manifest_path)
    except TrestleError as error:
        raise TrestleError(f'Unable to load signing manifest JSON: {manifest_path}: {error}') from error

    if not isinstance(manifest_data, dict):
        raise TrestleError('Signing manifest must be a JSON object.')

    _reject_unknown_fields(manifest_data, MANIFEST_FIELDS, 'Signing manifest')
    primary_artifact = _required_string(manifest_data, 'primaryArtifact', 'Signing manifest')
    artifacts_data = manifest_data.get('artifacts')
    if not isinstance(artifacts_data, list) or not artifacts_data:
        raise TrestleError('Signing manifest artifacts must be a non-empty list.')

    artifacts: List[ManifestArtifact] = []
    artifact_names = set()
    for index, artifact_data in enumerate(artifacts_data):
        if not isinstance(artifact_data, dict):
            raise TrestleError(f'Signing manifest artifact at index {index} must be a mapping.')
        _reject_unknown_fields(artifact_data, ARTIFACT_FIELDS, f'Signing manifest artifact at index {index}')
        name = _required_string(artifact_data, 'name', f'Signing manifest artifact at index {index}')
        uri = _required_string(artifact_data, 'uri', f'Signing manifest artifact {name}')
        media_type = _required_string(artifact_data, 'mediaType', f'Signing manifest artifact {name}')
        if name in artifact_names:
            raise TrestleError(f'Signing manifest contains a duplicate artifact name: {name}')
        artifact_names.add(name)
        artifact_path = _artifact_path(manifest_path.parent, uri)
        _validate_artifact_path(artifact_path)
        artifacts.append(ManifestArtifact(name, uri, media_type, artifact_path))

    if primary_artifact not in artifact_names:
        raise TrestleError(f'Signing manifest primaryArtifact is not listed in artifacts: {primary_artifact}')

    return SigningManifest(manifest_path, primary_artifact, artifacts)

def verify_manifest_envelope(
    manifest: SigningManifest, envelope: Dict[str, Any], public_key: Key, digest_algorithm: Optional[Algorithm] = None
) -> Dict[str, Any]:
    """Verify a package, detecting its signed digest algorithm unless one is required."""
    payload = verify_dsse_payload(envelope, public_key)
    statement = load_in_toto_statement(payload)
    _validate_manifest_statement(statement, manifest, digest_algorithm)
    return statement