Related functionality of SSHSIG signature verification

[castedo]

This is a discussion item regarding possible new documentation or addition of the following functionality.

I have a preliminary packaging of Python code that performs SSHSIG [1] signature verification at:

https://gitlab.com/perm.pub/sshsiglib

It is currently "vendored" (loosely speaking) into the hidos Python package (https://pypi.org/project/hidos/). I use it to perform SSH key signature verification on git commits with the dulwich Python package (https://pypi.org/project/dulwich/). Long-term, I do not think it makes sense for this code to stay buried inside the specialized application of hidos.

My current inclination is to deploy this SSHSIG signature verification code as a tiny independent Python package called sshsig. But it occurred to me that maybe it should eventually live inside the cryptography package? Any thoughts?

Regardless, in the medium-term, it probably makes sense for this SSHSIG verification code to exist as a tiny independent Python package. I've already done most of the work to do so.

I had originally thought of embedding it inDulwich [2] but now that I've seen the details of doing that, I'm now more inclined to make it a separate Python package on PyPI.

This is code heavily adapted from code originally written by @grawity. Thank you!

[1] https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.sshsig
[2] jelmer/dulwich#1391

[alex]

I don't have strong feels about whether it makes sense for SSHSIG to live in cryptography or not.

If someone wants to propose some specific APIs for cryptography, that's something we could consider.