feat: Add an example extension that defines a protocol for signing messages. #238

mikeas1 · 2025-07-18T20:43:33Z

This is an example to illustrate how extensions can be defined and implemented. The example shows a few aspects of extensions that are interesting:

Exposing data in an AgentCard via the params field
Requiring activation for the extension to be used.
Providing a library for agent developers to use in their agent implementation for direct coordination.
Showing decorators as an implementation pattern for transparent(ish) extension usage.

I plan to follow this up with actually using this extension in a sample agent.

messages. This is an example to illustrate how extensions can be defined and implemented. The example shows a few aspects of extensions that are interesting: 1. Exposing data in an AgentCard via the `params` field 2. Requiring activation for the extension to be used. 3. Providing a library for agent developers to use in their agent implementation for direct coordination. 4. Showing decorators as an implementation pattern for transparent(ish) extension usage. I plan to follow this up with actually using this extension in a sample agent.

gemini-code-assist

Summary of Changes

Hello @mikeas1, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new example extension focused on message signing, designed to showcase various advanced capabilities of the A2A extension framework. It provides a complete implementation in Python along with a formal specification, demonstrating how agents can expose capabilities, require activation, and integrate custom logic for secure communication.

Highlights

New Example Extension: I've added a new example extension for message signing (v1) to demonstrate how extensions can be defined and implemented within the A2A framework. This serves as a blueprint for future extension development.
Message Signing Protocol: This PR defines a clear protocol for adding and verifying digital signatures on Message and Artifact objects. It leverages JSON Web Signatures (JWS) and JSON Canonicalization Scheme (JCS) to ensure message integrity and authenticity.
Extension Capabilities Showcase: The example illustrates several key extension features: exposing public keys via AgentCard parameters, requiring explicit activation for the extension to be used, and utilizing decorator patterns (SigningEventQueue, SigningAgentExecutor) for transparent integration into agent execution flows.
Python Implementation & Specification: I've provided a concrete Python implementation of the signing extension, including utility classes for signing and verification, and integration with a2a-sdk components. Additionally, a detailed Markdown specification (spec.md) outlines the extension's URI, parameters, signature field structure, and the precise signing and verification process.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a new example extension for signing A2A messages. The review focuses on correctness and consistency between the specification and the implementation, identifying critical issues like typos and incorrect API usage, as well as inconsistencies in the specification.

samples/extensions/signing/v1/python/signing.py

samples/extensions/signing/v1/spec.md

samples/extensions/signing/v1/python/signing.py

samples/extensions/signing/v1/spec.md

mikeas1 · 2025-07-23T17:43:22Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces an example of an A2A extension for message signing. The review focuses on improving usability and robustness, including addressing a local-only dependency, simplifying the SigningExtension API, and making the signing function more resilient.

gemini-code-assist · 2025-07-23T17:44:52Z

samples/extensions/signing/v1/python/pyproject.toml

+requires-python = ">=3.10"
+dependencies = [
+    # DO NOT SUBMIT: Local path.
+    "a2a-sdk @ {root:uri}/../../../../../../a2a-python",


The a2a-sdk dependency is configured using a local file path. To make this example more accessible, consider using a public or private package index, or provide clear instructions in the README for setting up the local dependency.

gemini-code-assist · 2025-07-23T17:44:52Z

samples/extensions/signing/v1/python/src/a2a_signing_ext/signing.py

+        self, client: httpx.AsyncClient, message: Message
+    ) -> RemoteAgent | None:
+        """Retrieve the verified author of a message, if the message is signed.
+
+        Raises an error if a signature is present but verification fails.
+        """
+        return await get_agent_author(client, message)


The get_agent_author method is an async instance method that doesn't use any instance attributes (i.e., self) and just proxies to the top-level get_agent_author function. Consider removing this method and suggesting users import and call the top-level function directly for verifying signatures.

gemini-code-assist · 2025-07-23T17:44:52Z

samples/extensions/signing/v1/python/src/a2a_signing_ext/signing.py

+    sig_jws = jws.JWS(signing_payload)
+    sig_jws.add_signature(
+        signing_key,
+        protected={'alg': 'ES256'},


The signing algorithm is hardcoded to ES256. To enhance robustness, consider inferring the alg from the signing_key's properties or adding a validation check to ensure the provided key is compatible with ES256.

holtskinner

I actually think this would make sense to be in a top level directory called extensions (alongside samples, notebooks, demo)

Also, be sure to update to the snake_case syntax. You can use this script https://github.com/a2aproject/a2a-samples/blob/main/samples/python/refactor_camel_to_snake.sh

holtskinner · 2025-08-05T15:27:16Z

samples/extensions/signing/v1/python/pyproject.toml

+requires-python = ">=3.10"
+dependencies = [
+    # DO NOT SUBMIT: Local path.
+    "a2a-sdk @ {root:uri}/../../../../../../a2a-python",


Can this be updated to a2a-sdk 0.3.0

holtskinner · 2025-08-05T15:28:10Z

samples/extensions/signing/v1/python/tests/test_signing.py

+                    )
+                ]
+            ),
+            defaultInputModes=[],


Be sure to change all of these to use the updated SDK syntax.

gemini-code-assist bot reviewed Jul 18, 2025

View reviewed changes

mikeas1 added 3 commits July 18, 2025 21:12

Code review fixes

b5cb931

Add tests, change file layout to make it work

68248df

Merge branch 'main' into signing-ext-spec

0c5e617

gemini-code-assist bot reviewed Jul 23, 2025

View reviewed changes

holtskinner marked this pull request as ready for review August 5, 2025 15:26

holtskinner requested changes Aug 5, 2025

View reviewed changes

holtskinner assigned mikeas1 Aug 5, 2025

mikeas1 marked this pull request as draft September 2, 2025 20:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add an example extension that defines a protocol for signing messages. #238

feat: Add an example extension that defines a protocol for signing messages. #238

Uh oh!

mikeas1 commented Jul 18, 2025

gemini-code-assist bot left a comment

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikeas1 commented Jul 23, 2025

gemini-code-assist bot left a comment

gemini-code-assist bot Jul 23, 2025

gemini-code-assist bot Jul 23, 2025

gemini-code-assist bot Jul 23, 2025

holtskinner left a comment

holtskinner Aug 5, 2025

holtskinner Aug 5, 2025

feat: Add an example extension that defines a protocol for signing messages. #238

Are you sure you want to change the base?

feat: Add an example extension that defines a protocol for signing messages. #238

Uh oh!

Conversation

mikeas1 commented Jul 18, 2025

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mikeas1 commented Jul 23, 2025

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

gemini-code-assist bot Jul 23, 2025

Choose a reason for hiding this comment

gemini-code-assist bot Jul 23, 2025

Choose a reason for hiding this comment

gemini-code-assist bot Jul 23, 2025

Choose a reason for hiding this comment

holtskinner left a comment

Choose a reason for hiding this comment

holtskinner Aug 5, 2025

Choose a reason for hiding this comment

holtskinner Aug 5, 2025

Choose a reason for hiding this comment