Signers

openssl genrsa -out arweave-key.pem 4096

from agentsystems_notary import LocalKeySignerConfig

# From file path
signer = LocalKeySignerConfig(
    private_key_path="/path/to/arweave-key.pem",
)

# Or from environment variable
signer = LocalKeySignerConfig(
    private_key_env_var="ARWEAVE_PRIVATE_KEY",
)

from agentsystems_notary import AwsKmsSignerConfig

signer = AwsKmsSignerConfig(
    kms_key_arn="arn:aws:kms:us-east-1:123456789:key/abcd-1234-...",
    aws_access_key_id="AKIA...",
    aws_secret_access_key="...",
    aws_region="us-east-1",  # default
)

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["kms:Sign", "kms:GetPublicKey"],
    "Resource": "arn:aws:kms:us-east-1:123456789:key/abcd-1234-..."
  }]
}

from agentsystems_notary import GcpKmsSignerConfig

signer = GcpKmsSignerConfig(
    key_resource_name="projects/.../locations/.../keyRings/.../cryptoKeys/.../cryptoKeyVersions/...",
    credentials_path="/path/to/service-account.json",  # optional, uses ADC if not provided
)

from agentsystems_notary import AzureKeyVaultSignerConfig

signer = AzureKeyVaultSignerConfig(
    vault_url="https://acme-vault.vault.azure.net",
    key_name="arweave-signing-key",
    key_version="abc123",  # optional, uses latest if not provided
)