https://github.com/diveprotocol/opendive-client
Python library and CLI for Domain-based Integrity Verification Enforcement (DIVE)
https://github.com/diveprotocol/opendive-client
dive-client dive-protocol python-cli python-library python3
Last synced: about 1 month ago
JSON representation
Python library and CLI for Domain-based Integrity Verification Enforcement (DIVE)
- Host: GitHub
- URL: https://github.com/diveprotocol/opendive-client
- Owner: diveprotocol
- License: mit
- Created: 2026-03-30T13:47:08.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-04-01T16:50:48.000Z (about 1 month ago)
- Last Synced: 2026-04-03T06:29:42.463Z (about 1 month ago)
- Topics: dive-client, dive-protocol, python-cli, python-library, python3
- Language: Python
- Homepage: https://diveprotocol.org
- Size: 82 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Citation: CITATION.cff
- Security: SECURITY.md
- Roadmap: ROADMAP.md
Awesome Lists containing this project
README
# OpenDIVE: Python Client for Domain-based Integrity Verification Enforcement (DIVE)
[](https://opensource.org/licenses/MIT)
[](https://www.python.org/)
[](https://github.com/diveprotocol/opendive-client/releases)
[](https://github.com/diveprotocol/opendive-client)
**OpenDIVE** is a Python client library for the **DIVE protocol** (Domain-based Integrity Verification Enforcement), a cryptographic protocol that leverages **DNSSEC** to verify the integrity and authenticity of web resources. DIVE operates as an additional security layer above HTTP/HTTPS, ensuring that resources are signed and validated against DNS-published keys.
---
## Features
- **DNSSEC-backed verification**: Uses DNS TXT records (`_dive`, `_divekey`) to publish policies and public keys.
- **Cryptographic signatures**: Supports **Ed25519** and **Ed448** for signing, and **SHA-256/384/512** for hashing.
- **CLI tool**: Includes commands for verification, key generation, signing, and DNS inspection.
- **Incremental deployment**: Works alongside existing infrastructure without breaking non-DIVE clients.
- **Reporting**: Sends verification failure reports to a configurable endpoint.
---
## Installation
### From PyPI (Alpha Release)
```bash
pip install opendive-client
```
### From Source
```bash
git clone https://github.com/diveprotocol/opendive-client.git
cd opendive-client
pip install -e .
```
### Dependencies
- Python 3.8+
- `dnspython` (DNSSEC resolution)
- `cryptography` (Ed25519/Ed448 support)
- `httpx` (HTTP client)
- `click` (CLI)
---
## Usage
### CLI Commands
OpenDIVE provides a CLI for common operations:
```bash
# Verify a resource
opendive verify https://example.com/file.tar.gz
# Download a resource (only if DIVE verification passes)
opendive download https://example.com/file.tar.gz
# Generate a key pair
opendive keygen --alg ed25519 --key-id mykey --domain example.com
# Sign a file
opendive sign myfile.tar.gz --private-key --key-id mykey
# Inspect DNS records
opendive dns example.com --key-id mykey
```
### Python Library
```python
from dive.client import DiveClient
client = DiveClient(require_dnssec=True)
result = client.verify("https://example.com/file.tar.gz")
if result.accepted:
print("Resource is authentic!")
else:
print(f"DIVE rejected resource: {result.failure_reason}")
```
---
## Documentation
### DIVE Protocol
- [Draft RFC](https://datatracker.ietf.org/doc/draft-callec-dive/) (Work in Progress)
- [DIVE Website](https://diveprotocol.org)
### OpenDIVE API
- [CLI Reference](docs/cli.md) (TODO)
- [Python API](docs/api.md) (TODO)
---
## Development
### Running Tests
```bash
pytest tests/
```
### Contributing
Pull requests are welcome! For major changes, please open an issue first.
---
## License
MIT License. See [LICENSE](LICENSE) for details.
---
## Security
For security issues, see [SECURITY.md](SECURITY.md).
---
## Contact
- **Author**: Matéo Florian CALLEC
- **Email**: mateo@callec.net
- **GitHub**: [@diveprotocol](https://github.com/diveprotocol)