Module widget_signature 

Signed widget packages (docs/specs/SPEC_WIDGET_SHARING_2026_10_10.md §2).

A package may carry widget.sig: an Ed25519 signature by its publisher over its id, version and content hash. The content hash leaves widget.sig out, so signing doesn’t change what was approved. srv pins each publisher (the part of the id before the dot) to the first key the user approved for it, and reports any later package of that publisher signed by another key, or not signed, as key_changed.

Structs

SigFile 🔒

WidgetPublisherPin

A publisher pinned to a key, for Settings.

WidgetSignatureInfo

Enums

SignatureState

Constants

CONTEXT 🔒

SIG_FILE

SIG_VERSION 🔒

Functions

base32 🔒

RFC 4648 base32, no padding.

check

widget.sig in dir: None when there is none, the publisher’s public key (base64) when it verifies, or why it doesn’t.

describe

fingerprint

A key as people compare it: the first 10 bytes of its SHA-256, base32, in groups of four (K7Q2-MZ4D-PX3A-9TWE).

publisher_of

The publisher part of a package id (acme of acme.pr-dashboard).

read_pins

signed_message

The bytes a publisher signs.

verify 🔒

write_pins

Type Aliases

Pins

publisher → public key (base64).