signedjson

What it is and what it does

Signedjson is a library for cryptographically signing JSON objects using ED25519 signatures. It allows multiple entities to sign the same object, supports key rotation by permitting each entity to use multiple keys, and stores signatures in a standard format alongside optional unprotected metadata. The core workflow is to generate a signing key, sign a JSON object with an entity name, then verify the signature using the corresponding verification key.

The package depends on canonicaljson for deterministic JSON serialization, unpaddedbase64 for signature encoding, pynacl for cryptographic operations, and typing utilities. It is designed for scenarios where JSON data needs cryptographic authentication—such as federation protocols, message signing, or tamper detection—but it has been abandoned since 2022 with no active maintenance.

Use it for:

• Sign configuration or state objects in distributed systems where multiple parties need to verify authenticity.
• Implement message signing in federation protocols or peer-to-peer systems using ED25519.
• Add cryptographic proof-of-origin to JSON API responses or data exports.
• Rotate signing keys without invalidating previously signed objects by supporting multiple key IDs per entity.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Signs and verifies JSON objects using ED25519 cryptographic signatures, supporting multiple signers and key rotation.

No, not recommended for new projects. The package is abandoned (last release 2022-03-29) with no active maintenance, an unclear license, and unspecified Python version support. While it has low install friction and no known vulnerabilities, the lack of updates and missing license metadata create legal and maintenance risks. Consider a maintained alternative if you need JSON signing.

Install

signedjson on PyPI

pip install signedjson

uv add signedjson

poetry add signedjson

Installing signedjson

Before you install

Low install friction with a pure-Python wheel and modest dependencies. However, the package is abandoned—last release was 2022-03-29, over 1599 days ago—so no active maintenance or security updates should be expected.

License in practice

License treatment is unclear; the package metadata contains no license declaration. Before use in production or distribution, verify the actual license terms in the repository or source.

Quickstart

pip install signedjson

from signedjson.key import generate_signing_key, get_verify_key
from signedjson.sign import sign_json, verify_signed_json

signing_key = generate_signing_key('zxcvb')
signed_json = sign_json({'my_key': 'my_data'}, 'Alice', signing_key)
verify_key = get_verify_key(signing_key)
verify_signed_json(signed_json, 'Alice', verify_key)

Verify before relying

• Whether the package's Python version support is truly unspecified or if there are implicit constraints from its dependencies.
• The actual license under which signedjson is distributed, since metadata is absent.
• Whether the abandoned status and lack of recent updates pose security or compatibility risks for current Python versions.

Package facts

Evidence: signedjson-1.1.4-py3-none-any.whl

Keywords: json

Tags

More Cryptography packages