import tempfile, mareforma
from mareforma import signing
with tempfile.TemporaryDirectory() as tmp:
# Two distinct signing keys: independence keys on distinct asserter
# keyids, both citing the same upstream.
ka, kb = f"{tmp}/a.key", f"{tmp}/b.key"
signing.bootstrap_key(ka); signing.bootstrap_key(kb)
signer_b = signing.load_private_key(kb)
with mareforma.open(tmp, key_path=ka) as graph:
graph.enroll_validator(
signing.public_key_to_pem(signer_b.public_key()), identity="b"
)
prior_id = graph.assert_claim(
"upstream reference", generated_by="agent/prior"
)
id_a = graph.assert_claim(
"finding A", supports=[prior_id], generated_by="agent/a"
)
id_b = graph.assert_claim(
"finding B", supports=[prior_id], generated_by="agent/b",
signer=signer_b,
)
assert graph.trust_map(id_a)