gistfile1.txt

import os
from getpass import getpass
from securesystemslib.signer import Signer
from tuf.api.metadata import Metadata, Key


JOSHUA_KEYID = "b78c9e4ff9048a1d9876a20f97fa1b3cb03223a0c520c7de730cfa9f5c7b77e5"
JKU_KEYID = "762cb22caca65de5e9b7b6baecb84ca989d337280ce6914b6440aea95769ad93"
os.environ["PYKCS11LIB"] = "/usr/lib/x86_64-linux-gnu/libykcs11.so"


def pin_handler(secret: str) -> str:
    return getpass("pin: ")

root_md = Metadata.from_file("metadata/root.json")
targets_bytes = open("metadata/targets.json", "rb").read()
targets_md = Metadata.from_bytes(targets_bytes)
key:Key = root_md.signed.get_key(JKU_KEYID)

signer = Signer.from_priv_key_uri("hsm:", key, pin_handler)

sig = signer.sign(targets_md.signed_bytes)

print("sig: ", sig.to_dict())

key.verify_signature(sig, targets_md.signed_bytes)

print("verified")