def generate_and_write_ed25519_keypair(filepath=None, password=None):
<EOL>ed25519_key = securesystemslib.keys.generate_ed25519_key()<EOL>if not filepath:<EOL><INDENT>filepath = os.path.join(os.getcwd(), ed25519_key['<STR_LIT>'])<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>'<EOL>'<STR_LIT>')<EOL><DEDENT>securesystemslib.formats.PATH_SCHEMA.check_match(filepath)<EOL>if password is None: <EOL><INDENT>password = get_password('<STR_LIT>'<EOL>'<STR_LIT>' + Fore.RED + filepath + Fore.RESET + '<STR_LIT>',<EOL>confirm=True)<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>')<EOL><DEDENT>securesystemslib.formats.PASSWORD_SCHEMA.check_match(password)<EOL>securesystemslib.util.ensure_parent_dir(filepath)<EOL>file_object = securesystemslib.util.TempFile()<EOL>keytype = ed25519_key['<STR_LIT>']<EOL>keyval = ed25519_key['<STR_LIT>']<EOL>scheme = ed25519_key['<STR_LIT>']<EOL>ed25519key_metadata_format = securesystemslib.keys.format_keyval_to_metadata(<EOL>keytype, scheme, keyval, private=False)<EOL>file_object.write(json.dumps(ed25519key_metadata_format).encode('<STR_LIT:utf-8>'))<EOL>file_object.move(filepath + '<STR_LIT>')<EOL>file_object = securesystemslib.util.TempFile()<EOL>if len(password):<EOL><INDENT>ed25519_key = securesystemslib.keys.encrypt_key(ed25519_key, password)<EOL><DEDENT>else:<EOL><INDENT>logger.debug('<STR_LIT>'<EOL>'<STR_LIT>')<EOL>ed25519_key = json.dumps(ed25519_key)<EOL><DEDENT>file_object.write(ed25519_key.encode('<STR_LIT:utf-8>'))<EOL>file_object.move(filepath)<EOL>return filepath<EOL>
<Purpose>
  Generate an Ed25519 keypair, where the encrypted key (using 'password' as
  the passphrase) is saved to <'filepath'>.  The public key portion of the
  generated Ed25519 key is saved to <'filepath'>.pub.  If the filepath is not
  given, the KEYID is used as the filename and the keypair saved to the
  current working directory.

  The private key is encrypted according to 'cryptography's approach:
  "Encrypt using the best available encryption for a given key's backend.
  This is a curated encryption choice and the algorithm may change over
  time."

<Arguments>
  filepath:
    The public and private key files are saved to <filepath>.pub and
    <filepath>, respectively.  If the filepath is not given, the public and
    private keys are saved to the current working directory as <KEYID>.pub
    and <KEYID>.  KEYID is the generated key's KEYID.

  password:
    The password, or passphrase, to encrypt the private portion of the
    generated Ed25519 key.  A symmetric encryption key is derived from
    'password', so it is not directly used.

<Exceptions>
  securesystemslib.exceptions.FormatError, if the arguments are improperly
  formatted.

  securesystemslib.exceptions.CryptoError, if 'filepath' cannot be encrypted.

<Side Effects>
  Writes key files to '<filepath>' and '<filepath>.pub'.

<Returns>
  The 'filepath' of the written key.