Create src/utils/crypto_seal.py

src/utils/crypto_seal.py

@@ -0,0 +1,58 @@
+import os
+from pyhanko.sign import signers
+from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+from pyhanko.sign.fields import SigFieldSpec
+import hashlib
+
+class SovereignSealer:
+    """
+    Cryptographic Enactment Utility for ARAVALLI-1.
+    Signs model weights and ecological findings with Category 1-SN Authority.
+    """
+    def __init__(self, key_path, cert_path, passphrase=None):
+        self.signer = signers.SimpleSigner.load(
+            key_path, cert_path, key_passphrase=passphrase
+        )
+
+    def sign_finding(self, pdf_path, output_path, reason="GOEC Category 1-SN Mandate"):
+        """Signs a PDF finding (like Annexure A) to make it legally unrepudiable."""
+        print(f"Sealing Ecological Finding: {pdf_path}")
+        with open(pdf_path, 'rb') as doc:
+            w = IncrementalPdfFileWriter(doc)
+            # Create a visible signature field in the 'Sovereign Corner'
+            meta = signers.PdfSignatureMetadata(
+                field_name='GOEC_Secretariat_Seal',
+                reason=reason,
+                location='India Node'
+            )
+            
+            with open(output_path, 'wb') as out_f:
+                signers.sign_pdf(
+                    w, meta, signer=self.signer, output=out_f
+                )
+        print(f"Mandate Enacted: {output_path}")
+
+    def generate_weight_manifest(self, model_path):
+        """Generates a signed SHA-256 manifest of the model weights."""
+        sha256_hash = hashlib.sha256()
+        with open(model_path, "rb") as f:
+            for byte_block in iter(lambda: f.read(4096), b""):
+                sha256_hash.update(byte_block)
+        
+        weight_hash = sha256_hash.hexdigest()
+        manifest_content = f"ARAVALLI-1_MODEL_HASH: {weight_hash}\nSTATUS: CATEGORY-1-SN\n"
+        
+        # Save as a text file for separate signing or inclusion in a PDF report
+        manifest_path = model_path + ".manifest"
+        with open(manifest_path, "w") as f:
+            f.write(manifest_content)
+        return manifest_path
+
+if __name__ == "__main__":
+    # Example usage for the Secretariat
+    sealer = SovereignSealer(
+        key_path="certs/goec_private.pem", 
+        cert_path="certs/goec_cert.pem",
+        passphrase=b"survival_priority_2026"
+    )
+    # sealer.sign_finding("annex_a.pdf", "annex_a_signed.pdf")