feat: Attested Signatures + UCAN Principal Clarification

.github/workflows/workspace-test.yml

@@ -0,0 +1,16 @@
+name: Workspace Test
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: workspace-test-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  workspace-test:
+    uses: fil-forge/libforge/.github/workflows/go-workspace-test.yml@v1

Dockerfile

@@ -1,5 +1,5 @@
 # Build stage — native platform for fast cross-compilation
-FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
+FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS build
 
 ARG TARGETARCH
 ARG TARGETOS=linux

Dockerfile.dev

@@ -3,7 +3,7 @@
 # Run:   docker run -p 2345:2345 guppy:dev [args...]
 # Connect debugger to localhost:2345
 
-FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
+FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS build
 
 ARG TARGETARCH
 ARG TARGETOS=linux

cmd/gateway/serve.go

@@ -15,7 +15,7 @@ import (
 
 	contentcmds "github.com/fil-forge/libforge/commands/content"
 	"github.com/fil-forge/ucantone/did"
-	uted25519 "github.com/fil-forge/ucantone/principal/ed25519"
+	uted25519 "github.com/fil-forge/ucantone/multikey/ed25519"
 	"github.com/fil-forge/ucantone/ucan"
 	"github.com/ipfs/boxo/blockservice"
 	"github.com/ipfs/boxo/blockstore"
@@ -101,7 +101,6 @@ var serveCmd = &cobra.Command{
 			"Spaces can be specified by DID or by name.",
 		80),
 	RunE: func(cmd *cobra.Command, args []string) error {
-
 		cfg, err := config.Load[config.Config]()
 		if err != nil {
 			return fmt.Errorf("loading config: %w", err)
@@ -115,11 +114,10 @@ var serveCmd = &cobra.Command{
 
 		c := cmdutil.MustGetClient(cfg)
 
-		edSigner, ok := c.Issuer().(uted25519.Signer)
-		if !ok {
-			return fmt.Errorf("agent key is not ed25519")
+		if c.Issuer().Code() != uted25519.Code {
+			return fmt.Errorf("agent key is not ed25519 (got %s)", c.Issuer().Code())
 		}
-		goKey := ed25519.NewKeyFromSeed(edSigner.Raw())
+		goKey := ed25519.NewKeyFromSeed(c.Issuer().Raw())
 		pub, err := crypto.UnmarshalEd25519PublicKey(goKey.Public().(ed25519.PublicKey))
 		cobra.CheckErr(err)
 		peerID, err := peer.IDFromPublicKey(pub)

cmd/identity/generate.go

@@ -5,7 +5,7 @@ import (
 	"os"
 
 	"github.com/fil-forge/libforge/identity"
-	"github.com/fil-forge/ucantone/principal/ed25519"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
 	"github.com/spf13/cobra"
 )
 
@@ -20,17 +20,17 @@ The DID is printed to stderr for convenience.
 `,
 	Example: "guppy identity generate > my-key.pem",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		signer, err := ed25519.Generate()
+		issuer, err := ed25519.GenerateIssuer()
 		if err != nil {
 			return fmt.Errorf("generating ed25519 key: %w", err)
 		}
-		pem, err := identity.EncodeEd25519SignerToPEM(signer)
+		pem, err := identity.EncodeSignerToPEM(issuer)
 		if err != nil {
 			return fmt.Errorf("encoding key to PEM: %w", err)
 		}
 		cmd.SetOut(os.Stdout)
 		cmd.SetErr(os.Stderr)
-		cmd.PrintErrf("# %s\n", signer.DID())
+		cmd.PrintErrf("# %s\n", issuer.DID())
 		cmd.Print(string(pem))
 		return nil
 	},

cmd/internal/upload/demo/demo.go

@@ -15,7 +15,8 @@ import (
 	uploadcmds "github.com/fil-forge/libforge/commands/upload"
 	"github.com/fil-forge/libforge/digestutil"
 	"github.com/fil-forge/ucantone/did"
-	"github.com/fil-forge/ucantone/principal/ed25519"
+	"github.com/fil-forge/ucantone/multikey"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
 	"github.com/ipfs/go-cid"
 	"github.com/multiformats/go-multihash"
 
@@ -200,9 +201,9 @@ func Demo(ctx context.Context, repo *sqlrepo.Repo, spaceName string, alterMetada
 	if err != nil {
 		return fmt.Errorf("creating space key: %w", err)
 	}
-	spaceDID := space.DID()
+	spaceDID := space.KeyDID()
 
-	service, err := ed25519.Generate()
+	service, err := ed25519.GenerateIssuer()
 	if err != nil {
 		return fmt.Errorf("creating service key: %w", err)
 	}
@@ -244,7 +245,7 @@ func Demo(ctx context.Context, repo *sqlrepo.Repo, spaceName string, alterMetada
 // so the demo can exercise the full scan -> DAG -> shard -> upload pipeline
 // without real credentials or a service.
 type demoClient struct {
-	service ed25519.Signer
+	service multikey.Issuer
 }
 
 var _ storacha.Client = (*demoClient)(nil)

cmd/login.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/fil-forge/guppy/internal/cmdutil"
 	"github.com/fil-forge/guppy/pkg/config"
-	"github.com/fil-forge/guppy/pkg/didmailto"
+	"github.com/fil-forge/libforge/attestation/didmailto"
 )
 
 var loginCmd = &cobra.Command{
@@ -36,7 +36,7 @@ var loginCmd = &cobra.Command{
 		ctx := cmd.Context()
 		email := cmd.Flags().Arg(0)
 
-		accountDid, err := didmailto.FromEmail(email)
+		accountDid, err := didmailto.New(email)
 		if err != nil {
 			cmd.SilenceUsage = false
 			return err

cmd/root.go

@@ -12,6 +12,7 @@ import (
 	"github.com/fil-forge/guppy/cmd/blob"
 	"github.com/fil-forge/guppy/cmd/unixfs"
 	"github.com/fil-forge/guppy/pkg/presets"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
 	logging "github.com/ipfs/go-log/v2"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
@@ -26,7 +27,6 @@ import (
 	"github.com/fil-forge/guppy/cmd/space"
 	"github.com/fil-forge/guppy/cmd/upload"
 	libid "github.com/fil-forge/libforge/identity"
-	"github.com/fil-forge/ucantone/principal/ed25519"
 )
 
 var (
@@ -151,7 +151,7 @@ func initConfig() {
 					if err != nil {
 						log.Fatalf("failed to generate identity: %v", err)
 					}
-					pem, err := libid.EncodeEd25519SignerToPEM(signer)
+					pem, err := libid.EncodeSignerToPEM(signer)
 					if err != nil {
 						log.Fatalf("failed to encode identity to PEM: %v", err)
 					}

cmd/space/generate.go

@@ -14,7 +14,8 @@ import (
 	"github.com/fil-forge/guppy/pkg/config"
 	"github.com/fil-forge/guppy/pkg/didmailto"
 	"github.com/fil-forge/ucantone/did"
-	"github.com/fil-forge/ucantone/principal/ed25519"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
+	"github.com/fil-forge/ucantone/ucan"
 	"github.com/fil-forge/ucantone/ucan/command"
 	"github.com/fil-forge/ucantone/ucan/delegation"
 )
@@ -42,7 +43,7 @@ var generateCmd = &cobra.Command{
 			"local store.",
 		80),
 	RunE: func(cmd *cobra.Command, args []string) error {
-		space, err := ed25519.Generate()
+		space, err := ed25519.GenerateIssuer()
 		if err != nil {
 			cmd.SilenceUsage = false
 			return fmt.Errorf("generating signer for space: %w", err)
@@ -129,7 +130,7 @@ func pickAccount(cmd *cobra.Command, accounts []did.DID, flagValue, flagName str
 // grant delegates full access to the space to both the agent (so it can act on
 // the space locally) and the account (stored on the service via access/delegate),
 // recording the space's name in the delegation metadata.
-func grant(ctx context.Context, c *client.Client, space ed25519.Signer, account did.DID, name string) error {
+func grant(ctx context.Context, c *client.Client, space ucan.Issuer, account did.DID, name string) error {
 	opts := []delegation.Option{delegation.WithNoExpiration()}
 	if name != "" {
 		opts = append(opts, delegation.WithMetadata(client.SpaceNameMetadata(name)))

cmd/whoami.go

@@ -23,11 +23,11 @@ var whoamiCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		id, err := identity.DecodeEd25519SignerFromPEM(pem)
+		id, err := identity.DecodeSignerFromPEM(pem)
 		if err != nil {
 			return err
 		}
-		cmd.Println(id.DID())
+		cmd.Println(id.KeyDID())
 		return nil
 	},
 }

examples/byoidentity/byoidentity.go

@@ -10,14 +10,16 @@ import (
 	"github.com/fil-forge/guppy/pkg/tokenstore"
 	uploadcmds "github.com/fil-forge/libforge/commands/upload"
 	"github.com/fil-forge/ucantone/did"
-	"github.com/fil-forge/ucantone/principal/ed25519"
+	"github.com/fil-forge/ucantone/multikey"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
 	"github.com/fil-forge/ucantone/ucan/container"
 )
 
 func main() {
 	// private key to sign invocation UCAN with
 	keybytes, _ := os.ReadFile("path/to/private.key")
-	agent, _ := ed25519.FromRaw(keybytes)
+	agentSigner, _ := ed25519.FromRaw(keybytes)
+	agent := multikey.KeyIssuer(agentSigner)
 
 	// UCAN proof that signer can list uploads in this space (a delegation chain)
 	prfContainerBytes, _ := os.ReadFile("path/to/proof.ucan")

examples/loginflow/loginflow.go

@@ -8,15 +8,15 @@ import (
 	"github.com/fil-forge/guppy/pkg/presets"
 	uploadcmds "github.com/fil-forge/libforge/commands/upload"
 	"github.com/fil-forge/ucantone/did"
-	"github.com/fil-forge/ucantone/principal/ed25519"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
 )
 
 // Error handling omitted for brevity.
 
 func main() {
 	ctx := context.Background()
 
-	agent, _ := ed25519.Generate()
+	agent, _ := ed25519.GenerateIssuer()
 
 	// space to list uploads from
 	space, _ := did.Parse("did:key:z6MkwDuRThQcyWjqNsK54yKAmzfsiH6BTkASyiucThMtHt1y")