aletheia 0.4.0

Generate your public/private key pair

$ aletheia generate

  🔑  Generating private/public key pair...

  All finished!

  You now have two files: aletheia.pem (your private key) and
  aletheia.pub (your public key).  Keep the former private, and share
  the latter far-and-wide.  Importantly, place your public key at a
  publicly accessible URL so that when you sign a file with your
  private key, it can be verified by reading the public key at that
  URL.

Your public & private key will be stored in ${ALETHEIA_HOME}. For Aletheia to work, you need to publish your public key on a website somewhere so it can be used to verify files later.

Sign an image with your private key

$ aletheia sign file.jpg https://example.com/my-public-key.pub

  ✔  file.jpg was signed with your private key

Aletheia will modify the EXIF data on your image to include a signature and a link to where your public key can be found so when it comes time to verify it, everything that’s necessary is available.

Verify the image with your public key

$ aletheia verify file.jpg

  ✔  The file is verified as having originated at example.com

Now, anyone who receives your image can verify its origin with this command so long as your public key remains available at the URL you used above.

Generate your public/private key pair

from aletheia.utils import generate

generate()

Just like the command line utility, generate() will create your public/private key pair in ${ALETHEIA_HOME}.

Sign an image with your private key

from aletheia.utils import sign

sign("/path/to/file.jpg", "https://example.com/my-public-key.pub")

So long as you’ve got your public/private key pair in ${ALETHEIA_HOME}, sign() will modify the metadata on your file to include a signature and URL for your public key.

There is also a sign_bulk() utility for multiple files:

from aletheia.utils import sign

sign(
    ("/path/to/file1.jpg", "/path/to/file2.jpg"),
    "https://example.com/my-public-key.pub"
)

Verify the image with your public key

from aletheia.utils import verify

verify("/path/to/file.jpg")

Aletheia will import the public key from the URL in the file’s metadata and attempt to verify the image data by comparing the key to the embedded signature. If the file is verified, it returns True, otherwise it returns False.

There’s also a verify_bulk() utility for multiple files:

from aletheia.utils import verify

verify_bulk(("/path/to/file1.jpg", "/path/to/file2.jpg"))