Function sign_payload

src/orgkernel/crypto_utils.py:105–123

Sign a canonical JSON payload with an Ed25519 private key. Args: private_key_pem: PKCS8 PEM-encoded private key. payload: Canonical JSON string to sign. Returns: Base64url-encoded Ed25519 signature (no padding).

(private_key_pem: str, payload: str)

def sign_payload(private_key_pem: str, payload: str) -> str:
    """
    Sign a canonical JSON payload with an Ed25519 private key.

    Args:
        private_key_pem: PKCS8 PEM-encoded private key.
        payload: Canonical JSON string to sign.

    Returns:
        Base64url-encoded Ed25519 signature (no padding).
    """
    private_key = serialization.load_pem_private_key(
        private_key_pem.encode("utf-8"),
        password=None,
    )
    if not isinstance(private_key, ed25519.Ed25519PrivateKey):
        raise TypeError("Private key must be Ed25519.")
    signature = private_key.sign(payload.encode("utf-8"))
    return base64.urlsafe_b64encode(signature).decode().rstrip("=")


def verify_signature(