Kinto signer is a Kinto plugin that makes it possible to sign the updates of Kinto collections. In other words, it's a way to verify that the data the client has got is the data the original authors intended to distribute.

This works with two Kinto instances:

• A, the authority (also known as "the signer"). It is where the original data are sent. The authority is configured to sign the data for a specific "origin".
• O, the origin, which will end up distributing the data and the signatures. It is where the client retrieve the data.

Once started, the authority is behaving like a normal Kinto server, until you ask for a signature of the collection. To trigger this signature operation, you need to add a specific field on the collection: status: "to-sign".

Here is how to do it with httpie:

echo '{"data": {"status": "to-sign"}}' | http PATCH http://0.0.0.0:8888/v1/buckets/default/collections/tasks --auth user:pass

From there, the authority will:

1. Retrieve all records on the collection, compute a hash of the records, and generate a signature out of it.
2. Send all local changes to the Origin server, with a signature.
3. Update the collection metadata with status:signed.

To install this plugin in a Kinto server, a few configuration variables need to be set.

Here is an example of what a configuration could look like:

kinto.includes = kinto_signer

kinto.signer.resources =
    source/collection1;destination/collection1
    source/collection2;destination/collection2

Kinto signer can integrate with the Autograph server. To do so, use the following settings:

To generate a new keypair, you can use the following command:

$ python -m kinto_signer.generate_keypair private.pem public.pem

To run the unit tests:

$ make tests

For the functional tests:

$ make run-signer
$ make functional