httk.core.project.seal

Create and verify signed, private-key-free project redistributions.

Path and suffix exclusions are the primary private-key protection. The content guard catches exact and re-encoded copies of known private material; arbitrarily transformed or truncated secrets are outside its scope.

Attributes

PROJECT_PRIVATE_KEY_RELATIVE_PATH

The exact private-key path created by the project identity implementation.

Functions

seal_project(out_path[, project_path])	Create a signed ZIP containing a project without private keys.
verify_seal(zip_path, *[, expect_key, trusted_keys])	Verify a sealed project ZIP and return signer information.

Module Contents

httk.core.project.seal.PROJECT_PRIVATE_KEY_RELATIVE_PATH = 'httk_project/keys/project.seed'

The exact private-key path created by the project identity implementation.

httk.core.project.seal.seal_project(out_path, project_path=None)

Create a signed ZIP containing a project without private keys.

The path and suffix exclusions are primary. The content guard catches exact and re-encoded copies of known private material; transformed or truncated secrets are outside that guard’s scope.

Parameters:

• out_path (str | pathlib.Path) – Destination ZIP path.

• project_path (str | pathlib.Path | None) – Project root, or None to discover the nearest project.

Returns:

The destination path.

Raises:

ValueError – If the project is unsafe to seal or its identity is invalid.

Return type:

pathlib.Path

httk.core.project.seal.verify_seal(zip_path, *, expect_key=None, trusted_keys=())

Verify a sealed project ZIP and return signer information.

Parameters:

• zip_path (str | pathlib.Path) – Seal ZIP to verify.

• expect_key (str | None) – Expected signer fingerprint or public key.

• trusted_keys (collections.abc.Iterable[str]) – Trusted signer fingerprints or public keys.

Returns:

A JSON-ready verification report.

Raises:

ValueError – If the ZIP, manifest, files, tree digest, or signature is invalid.

Return type:

dict[str, object]