Merged
Conversation
- RFC 8785 JCS canonicalizer (hand-written, ~90 lines, audit-friendly)
- Ed25519 verifier in src/verify.ts using node:crypto only — no
third-party crypto deps; whole verification path under 100 lines
- CLI with --dataset, --json, --offline, --keys, --no-cache flags
and six documented exit codes
- Trusted-keys loader with TTL cache at ~/.certifieddata/keys.json
- Fixture generator produces a real Ed25519 keypair and signs the
four canonical test cases (valid, tampered, unknown-key, malformed)
- 34 tests across canonicalize, verify, and CLI suites
- CI matrix: Node 20/22 × {linux,macos,windows}
- Publish workflow uses npm OIDC trusted publishing with provenance
…tures
The cli.ts entry guard `import.meta.url === \`file://${process.argv[1]}\``
never matches on Windows, where import.meta.url is `file:///C:/...` but
process.argv[1] is `C:\...`. Use pathToFileURL to produce a comparable
file URL.
Replace `chmod +x` in the build script with a node one-liner so it works
on Windows shells that lack chmod. Add .gitattributes to keep the CSV
and JSON fixtures byte-identical across platforms (CRLF would change
the dataset SHA-256).
The npm badge will render "no version found" until @certifieddata/verify v0.1.0 publishes; once the publish workflow fires on a v0.1.0 release, the badge auto-updates without further changes. CI badge tracks the ci.yml workflow on main; license badge is static MIT; Node badge reads the engines.node range from package.json. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Initial scaffold of
@certifieddata/verify— an audit-friendly Ed25519 verifier forcert.v1documents, intentionally built with zero third-party crypto dependencies so the verification path can be reviewed end-to-end in under 100 lines.src/canonicalize.ts— RFC 8785 JCS canonicalizer, hand-written (~90 lines).src/verify.ts— core verifier usingnode:cryptodirectly:crypto.verify('ed25519', canonicalBytes, publicKey, sigBytes). 117 total / 97 content lines.src/cli.ts— full flag handling (--dataset,--json,--offline,--keys,--no-cache), six exit codes (0VALID,1INVALID/DATASET_MISMATCH,2UNKNOWN_KEY,3MALFORMED,4NETWORK,64USAGE).~/.certifieddata/keys.json(--no-cacheand--offlineoverrides).--provenance; no NPM_TOKEN secret.Quality gate
npm run lint— cleannpm run typecheck— cleannpm test— 34/34 passing (canonicalize 14, verify 7, cli 13)npm pack --dry-run— 35 files, onlydist/,README.md,LICENSE(test artifacts excluded via negation)src/verify.tsreads top-to-bottom in under 100 content linesVALID,INVALID,UNKNOWN_KEY,MALFORMED)Test plan
src/verify.tstop-to-bottom and confirms the verification path is genuinely Ed25519-over-JCS-canonicalized payload.npm run fixturesand re-runsnpm testagainst fresh keys.certifieddata/verify.publish.ymlfires automatically.Out of scope (deferred)
reference-implfromnpm installtonpm ci— pending the first published@certifieddata/verify@0.1.0on npm.Generated by Claude Code