src/utils/crypto_seal.py

import os
from pyhanko.sign import signers
from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
from pyhanko.sign.fields import SigFieldSpec
import hashlib

class SovereignSealer:
    """
    Cryptographic Enactment Utility for ARAVALLI-1.
    Signs model weights and ecological findings with Category 1-SN Authority.
    """
    def __init__(self, key_path, cert_path, passphrase=None):
        self.signer = signers.SimpleSigner.load(
            key_path, cert_path, key_passphrase=passphrase
        )

    def sign_finding(self, pdf_path, output_path, reason="GOEC Category 1-SN Mandate"):
        """Signs a PDF finding (like Annexure A) to make it legally unrepudiable."""
        print(f"Sealing Ecological Finding: {pdf_path}")
        with open(pdf_path, 'rb') as doc:
            w = IncrementalPdfFileWriter(doc)
            # Create a visible signature field in the 'Sovereign Corner'
            meta = signers.PdfSignatureMetadata(
                field_name='GOEC_Secretariat_Seal',
                reason=reason,
                location='India Node'
            )
            
            with open(output_path, 'wb') as out_f:
                signers.sign_pdf(
                    w, meta, signer=self.signer, output=out_f
                )
        print(f"Mandate Enacted: {output_path}")

    def generate_weight_manifest(self, model_path):
        """Generates a signed SHA-256 manifest of the model weights."""
        sha256_hash = hashlib.sha256()
        with open(model_path, "rb") as f:
            for byte_block in iter(lambda: f.read(4096), b""):
                sha256_hash.update(byte_block)
        
        weight_hash = sha256_hash.hexdigest()
        manifest_content = f"ARAVALLI-1_MODEL_HASH: {weight_hash}\nSTATUS: CATEGORY-1-SN\n"
        
        # Save as a text file for separate signing or inclusion in a PDF report
        manifest_path = model_path + ".manifest"
        with open(manifest_path, "w") as f:
            f.write(manifest_content)
        return manifest_path

if __name__ == "__main__":
    # Example usage for the Secretariat
    sealer = SovereignSealer(
        key_path="certs/goec_private.pem", 
        cert_path="certs/goec_cert.pem",
        passphrase=b"survival_priority_2026"
    )
    # sealer.sign_finding("annex_a.pdf", "annex_a_signed.pdf")