Elysia Tools
Navigation
Workflow Playbook
Generate a test signing key, inspect AGEX bundle metadata, verify its signature with a trusted public key, and stop the handoff when evidence is incomplete.
Hubs
Use this review when a team has an AGEX bundle that must pass a focused signing gate before it is handed to another operator, environment, or partner. It suits release reviewers, security engineers, and operations staff who need a repeatable answer to three questions: what does the bundle expose, which key signed it, and is the evidence sufficient to continue?
This is a review of one artifact, not a promise that the entire supply chain is safe. Keep the bundle and expected metadata available, decide the acceptable AGEX version and visible fields, and identify the release record that names the trusted public-key fingerprint.
Start with agex-keypair-generator only for disposable test material. Protect the private key immediately and keep it out of the bundle, logs, and handoff note. The generated public key can support a controlled fixture, but it is not automatically the production trust anchor.
Use agex-bundle-inspector to capture the bundle version, filename, size, MIME type, signer information, and signature presence without decrypting plaintext. Compare those values with the agreed baseline. A package can have a cryptographically valid signature and still require review if its visible metadata is unexpected.
Run agex-signature-verifier with the public key whose origin was confirmed through an independent release record or owner-controlled channel. Check the verification result and the key fingerprint together. If the signature is absent, invalid, mismatched, or tied to an unknown key, stop the handoff, preserve the evidence, and request clarification or a replacement bundle.
Record the inspector output, verifier output, trust source, and final decision. For a broader package creation and delivery process, continue with the existing agex-secure-file-sharing workflow; this review does not transport files, prove identity, decrypt content, or provide absolute supply-chain assurance.
Workflow playbook
Generate an Ed25519 keypair for the review fixture, label it for the test context, record the public-key fingerprint, and protect the private half before any bundle or report is handled.
Inspect the AGEX bundle without decrypting it. Compare its format version, visible file fields, signer identifier, and signature presence with the expected release record, and retain the report for the gate decision.
Pass the bundle and the public key obtained from the independent trust source to the verifier. Confirm both the cryptographic result and the key fingerprint; do not substitute the newly generated test key unless the fixture is intentionally signed by it.
Archive the inspector and verifier results with the expected metadata and trust record. Hand off only when the signature is verified and all deviations are resolved; otherwise quarantine the bundle and document the failure.
Use the keypair generator for a disposable test path and record its public-key fingerprint. For a real handoff, verify with the public key supplied by the trusted release owner; a freshly generated key is not proof of production provenance by itself.
Before checking the signature, agree on the expected AGEX version, visible filename, size, MIME type, signer identifier, and signature presence. Unexpected metadata should be investigated rather than silently accepted.
Treat a missing signature, invalid signature, mismatched public key, or unknown fingerprint as a handoff stop. Preserve the bundle and reports, confirm the bytes and trust record out of band, and request a corrected artifact instead of bypassing the gate.