@parmana/verifier 0.3.0 → 1.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -202
- package/NOTICE +1 -1
- package/README.md +207 -159
- package/bin/parmana-verify.mjs +53 -53
- package/package.json +40 -40
- package/src/canonical.mjs +35 -35
- package/src/trust.mjs +104 -104
- package/src/verify.mjs +312 -312
package/README.md
CHANGED
|
@@ -1,159 +1,207 @@
|
|
|
1
|
-
# Parmana Verifier
|
|
2
|
-
|
|
3
|
-
[](https://github.com/pavancharak/parmana-verifier/actions/workflows/ci.yml) [](LICENSE) [](package.json)
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
Parmana signs an **Execution Trust Record** for every action an agent takes through it. The record says what was authorized, what ran, and what the outcome was, and it is signed with keys. This verifier checks that a record has not been changed and that it was signed by keys you chose to trust. It does not ask Parmana's servers anything, so you do not have to trust them to check a record.
|
|
8
|
-
|
|
9
|
-
The records come from [Parmana](https://github.com/pavancharak/parmana-core), which signs them. The verifier works without the rest of Parmana: it needs only a record and a trust file.
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
- **
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
```
|
|
24
|
-
|
|
25
|
-
```
|
|
26
|
-
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
```
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
A
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
-
|
|
102
|
-
-
|
|
103
|
-
- `
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
##
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
1
|
+
# Parmana Verifier
|
|
2
|
+
|
|
3
|
+
[](https://github.com/pavancharak/parmana-verifier/actions/workflows/ci.yml) [](LICENSE) [](package.json)
|
|
4
|
+
|
|
5
|
+
Every action stays within what your business allowed, and Parmana keeps proof of what happened. This verifier checks that proof using only a file and the keys you trust. No network access, no account, no dependencies.
|
|
6
|
+
|
|
7
|
+
Parmana signs an **Execution Trust Record** for every action an agent takes through it. The record says what was authorized, what ran, and what the outcome was, and it is signed with keys. This verifier checks that a record has not been changed and that it was signed by keys you chose to trust. It does not ask Parmana's servers anything, so you do not have to trust them to check a record.
|
|
8
|
+
|
|
9
|
+
The records come from [Parmana](https://github.com/pavancharak/parmana-core), which signs them. The verifier works without the rest of Parmana: it needs only a record and a trust file.
|
|
10
|
+
|
|
11
|
+
Test results, the security review scope and the changelog are indexed under [Reports and evidence](#reports-and-evidence).
|
|
12
|
+
|
|
13
|
+
## Who it is for
|
|
14
|
+
|
|
15
|
+
- **Auditors and reviewers** who need to confirm a record without relying on the system that produced it.
|
|
16
|
+
- **Operators** who want to check records in their own environment, with keys they pinned themselves.
|
|
17
|
+
- **Developers** who want a small, dependency-free reference implementation of the record checks.
|
|
18
|
+
|
|
19
|
+
## Quick start
|
|
20
|
+
|
|
21
|
+
Requires Node.js 24 or later. Ed25519 works on any Node 24 build; post-quantum ML-DSA-65 signatures need OpenSSL 3.5 or later. From a clone of this repository:
|
|
22
|
+
|
|
23
|
+
```sh
|
|
24
|
+
node bin/parmana-verify.mjs test/vectors/record-whole-record-v3.json test/vectors/trust-whole-record.json
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
```json
|
|
28
|
+
{"valid":true,"coverage":"full","errors":[],"checks":{"trustRecordHash":true,"signature":true,"hybridSignatures":true}}
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
The exit code is `0`. A record that has been changed is rejected:
|
|
32
|
+
|
|
33
|
+
```sh
|
|
34
|
+
node bin/parmana-verify.mjs test/vectors/record-tampered-amount.json test/vectors/trust.json
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
The exit code is `1`, and the output lists the failed checks. The test vectors are labelled test material; see [test/vectors/README.md](test/vectors/README.md). For real records, pin the keys you trust (see [Pinning a key](#pinning-a-key)).
|
|
38
|
+
|
|
39
|
+
## Installation and usage
|
|
40
|
+
|
|
41
|
+
The package is published on npm as [`@parmana/verifier`](https://www.npmjs.com/package/@parmana/verifier). Install it, or run it without installing:
|
|
42
|
+
|
|
43
|
+
```sh
|
|
44
|
+
npm install -g @parmana/verifier
|
|
45
|
+
parmana-verify <proof.json> <trust.json>
|
|
46
|
+
parmana-verify key-fingerprint <public-key.pem>
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
```sh
|
|
50
|
+
npx @parmana/verifier <proof.json> <trust.json>
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
From a clone of this repository, run the same commands with `node bin/parmana-verify.mjs` in place of `parmana-verify`.
|
|
54
|
+
|
|
55
|
+
There is also a Python version in [`python/`](python/README.md). It checks the same records and gives the same results, except that it cannot check ML-DSA-65 (hybrid) signatures. Use the Node version for those.
|
|
56
|
+
|
|
57
|
+
```sh
|
|
58
|
+
pip install parmana-verifier
|
|
59
|
+
parmana-verify <proof.json> <trust.json>
|
|
60
|
+
```
|
|
61
|
+
|
|
62
|
+
- `proof.json` is the Execution Trust Record.
|
|
63
|
+
- `trust.json` is the trust set. It lists each key you accept:
|
|
64
|
+
|
|
65
|
+
```json
|
|
66
|
+
{
|
|
67
|
+
"keys": [
|
|
68
|
+
{
|
|
69
|
+
"keyId": "default",
|
|
70
|
+
"algorithm": "ed25519",
|
|
71
|
+
"publicKeyPem": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n",
|
|
72
|
+
"fingerprint": "sha256:<64 hex digits>",
|
|
73
|
+
"validFrom": "2026-01-01T00:00:00.000Z",
|
|
74
|
+
"validUntil": null,
|
|
75
|
+
"compromised": false
|
|
76
|
+
}
|
|
77
|
+
]
|
|
78
|
+
}
|
|
79
|
+
```
|
|
80
|
+
|
|
81
|
+
- `key-fingerprint` prints the `sha256:` value to pin for a PEM key. To pin a key safely, follow the steps in [Pinning a key](#pinning-a-key).
|
|
82
|
+
|
|
83
|
+
The verify command prints one line of JSON and exits with `0` (valid), `1` (invalid, with reasons), or `2` (usage, missing file, or invalid JSON). The full input and output rules are in [docs/FORMAT.md](docs/FORMAT.md).
|
|
84
|
+
|
|
85
|
+
On Windows PowerShell, use the same commands with Windows paths, for example `node bin\parmana-verify.mjs proof.json trust.json`.
|
|
86
|
+
|
|
87
|
+
## Pinning a key
|
|
88
|
+
|
|
89
|
+
A signature proves only that a key made it. Before you trust a record, decide which keys you trust, and check that each key is the one its owner published.
|
|
90
|
+
|
|
91
|
+
1. Get the operator's public key PEM and the `sha256:` fingerprint they published. Get the fingerprint from a source other than the one that gave you the key, such as a signed message or a call to a known number.
|
|
92
|
+
2. Run `node bin/parmana-verify.mjs key-fingerprint public-key.pem` on the PEM you received.
|
|
93
|
+
3. Compare the two fingerprints character by character. If they differ, do not use the key.
|
|
94
|
+
4. Only then add the key to your trust file with that fingerprint.
|
|
95
|
+
|
|
96
|
+
## Trust rules
|
|
97
|
+
|
|
98
|
+
A key is used only if all of these hold:
|
|
99
|
+
|
|
100
|
+
- its PEM hashes to the pinned fingerprint (SHA-256 of the SPKI DER encoding);
|
|
101
|
+
- the algorithm named by the signature matches the algorithm in the trust file;
|
|
102
|
+
- it is not marked `compromised`;
|
|
103
|
+
- the record's `createdAt` is at or after `validFrom` and before `validUntil` (if set).
|
|
104
|
+
|
|
105
|
+
A compromised key is rejected whatever the timestamp, so signatures it made stay void.
|
|
106
|
+
|
|
107
|
+
## Examples
|
|
108
|
+
|
|
109
|
+
Run every example with:
|
|
110
|
+
|
|
111
|
+
```sh
|
|
112
|
+
npm run examples
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
The examples are in `examples/`, and each one prints what it checks:
|
|
116
|
+
|
|
117
|
+
- `01-verify-a-proof.mjs`: verify a record and explain each check.
|
|
118
|
+
- `02-tamper-detection.mjs`: change a signed field, then show that recomputing the hash does not help an attacker.
|
|
119
|
+
- `03-pinned-keys-and-windows.mjs`: how pinned fingerprints, validity windows and compromised keys decide what is accepted.
|
|
120
|
+
- `04-hybrid-envelope.mjs`: the Ed25519 and ML-DSA-65 entries of a hybrid record (needs Node 24).
|
|
121
|
+
- `05-build-and-verify-a-record.mjs`: build, hash, sign, pin and verify a record from scratch, with a runtime test key.
|
|
122
|
+
- `06-command-line.mjs`: the command-line exit codes, and fingerprinting a key for pinning.
|
|
123
|
+
- `07-whole-record-coverage.mjs`: what coverage `full` and `legacy` mean, and that a changed covered field is refused.
|
|
124
|
+
- `08-hybrid-cutover.mjs`: the `hybridRequiredFrom` cutover, and what it adds to a record created after it.
|
|
125
|
+
- `09-unsupported-schema-version.mjs`: a schema version other than 2 or 3 is refused, not guessed at.
|
|
126
|
+
|
|
127
|
+
Each example exits `0` when it behaves as described, so the set runs in CI.
|
|
128
|
+
|
|
129
|
+
## Testing
|
|
130
|
+
|
|
131
|
+
```sh
|
|
132
|
+
npm test
|
|
133
|
+
```
|
|
134
|
+
|
|
135
|
+
Run the tests on Node 24. On Node 22 or any runtime without ML-DSA-65, the hybrid tests are skipped. Test keys are generated at run time, labelled "TEST KEY - NOT FOR PRODUCTION", and never written to disk.
|
|
136
|
+
|
|
137
|
+
The suite covers the legacy signature and hash, hybrid signatures, schema version 3 coverage, the trust rules, the test vectors, and the command-line exit codes. Each area has its own file under `test/`.
|
|
138
|
+
|
|
139
|
+
## Limitations
|
|
140
|
+
|
|
141
|
+
- The verifier can only check that a record was signed by the key you pinned. It cannot prove that the key belongs to Parmana. That depends on how you obtained and compared the fingerprint.
|
|
142
|
+
- For records with `schemaVersion` 2, or with no `schemaVersion`, only the fields listed in [docs/FORMAT.md](docs/FORMAT.md) are protected. Any other field can be changed without the verifier noticing. Read decisions only from covered fields. See "Fields not covered by any signature" in that document.
|
|
143
|
+
- For records with `schemaVersion` 3, every field except the signature envelope, `verifications` and `receipts` is protected. Check that `coverage` is `full` when that matters.
|
|
144
|
+
- A record with `schemaVersion` 2 can be downgraded by someone who can write to storage, since `schemaVersion` is unsigned. Set `hybridRequiredFrom` in the trust file to reject downgraded records created after a cutover. Records before the cutover stay open to this.
|
|
145
|
+
- The validity window is checked against the record's `createdAt`, not against the signing time. A record that carries a false `createdAt` is checked against the window for that false time.
|
|
146
|
+
- Keys and fingerprints must be kept current. The verifier does not know about rotations or revocations that you have not written into the trust file.
|
|
147
|
+
- It does not verify the policy the record cites, the authorization decision logic, or the state of any connector or external system.
|
|
148
|
+
- It does not confirm that the action described by the record was executed.
|
|
149
|
+
- The records in `test/vectors/` were produced by the Parmana signing code and are test material only. They show that the checks agree with that code; they are not an independent specification.
|
|
150
|
+
|
|
151
|
+
## Reports and evidence
|
|
152
|
+
|
|
153
|
+
Every report is listed once, here. Start with the question you have.
|
|
154
|
+
|
|
155
|
+
**Test results**
|
|
156
|
+
|
|
157
|
+
- **Live CI runs:** the [CI workflow](https://github.com/pavancharak/parmana-verifier/actions/workflows/ci.yml) runs the tests and examples on every push. The [Python workflow](https://github.com/pavancharak/parmana-verifier/actions/workflows/python.yml) runs the Python package tests.
|
|
158
|
+
- **Test suite:** what it covers, and how to run it on Node 24, is under [Testing](#testing).
|
|
159
|
+
- **Test vectors:** labelled test records and keys, in [test/vectors/](test/vectors/README.md). They are for tests only, not for production use.
|
|
160
|
+
- **Examples:** nine runnable examples that check their own behaviour, run by `npm run examples` ([Examples](#examples)).
|
|
161
|
+
|
|
162
|
+
**Security**
|
|
163
|
+
|
|
164
|
+
- **Security review scope:** [docs/SECURITY-REVIEW.md](docs/SECURITY-REVIEW.md) is written for an external reviewer. It covers what the verifier claims, what to examine, and its known limits.
|
|
165
|
+
- **Security policy:** [SECURITY.md](SECURITY.md) explains how to report a vulnerability privately.
|
|
166
|
+
|
|
167
|
+
**Releases**
|
|
168
|
+
|
|
169
|
+
- **Changelog:** [CHANGELOG.md](CHANGELOG.md) lists each change to the record formats and the command-line interface.
|
|
170
|
+
|
|
171
|
+
---
|
|
172
|
+
## Read the Parmana blog
|
|
173
|
+
|
|
174
|
+
The [Parmana blog](https://blog.parmanasystems.com) explains how the verifier fits into the wider product, in plain terms. Read the post for your role:
|
|
175
|
+
|
|
176
|
+
- **Auditors and risk teams:** [Check a record offline, without trusting us](https://blog.parmanasystems.com/2026/10/25/check-a-record-offline/). How to verify a signed record with only a file and a trust file, and what the check does not cover.
|
|
177
|
+
- **Engineers:** [Run the checks in an afternoon](https://blog.parmanasystems.com/2026/10/25/run-the-checks-in-an-afternoon/). Build, test and verify a record from source.
|
|
178
|
+
- **Anyone who wants the honest picture:** [Lessons from the limits we still have](https://blog.parmanasystems.com/2026/10/25/lessons-from-the-limits-we-still-have/). What we got wrong, and what remains open.
|
|
179
|
+
|
|
180
|
+
New posts are published regularly, so check the blog for updates.
|
|
181
|
+
|
|
182
|
+
## Status
|
|
183
|
+
|
|
184
|
+
This is version 1.6.2, released with the SDK packages. Each change to the record formats or the command-line interface is listed in [CHANGELOG.md](CHANGELOG.md).
|
|
185
|
+
|
|
186
|
+
## Repository layout
|
|
187
|
+
|
|
188
|
+
| Path | Contents |
|
|
189
|
+
| ------------ | ------------------------------------------------------------------------ |
|
|
190
|
+
| `bin/` | The `parmana-verify` command-line entry point |
|
|
191
|
+
| `src/` | The checks: canonical JSON, hashing, signatures, trust rules |
|
|
192
|
+
| `test/` | The test suite, and `test/vectors/`, the labelled test records |
|
|
193
|
+
| `examples/` | Nine runnable examples, run by `npm run examples` |
|
|
194
|
+
| `docs/` | `FORMAT.md` (the input and output rules) and `SECURITY-REVIEW.md` |
|
|
195
|
+
| `reports/` | Pointer to the reports index in this README (see Reports and evidence) |
|
|
196
|
+
|
|
197
|
+
## Security
|
|
198
|
+
|
|
199
|
+
Do not open a public issue for a security problem. Report it through GitHub's private vulnerability reporting: open the **Security** tab and choose **Report a vulnerability**. See [SECURITY.md](SECURITY.md). The scope for an external review is in [docs/SECURITY-REVIEW.md](docs/SECURITY-REVIEW.md).
|
|
200
|
+
|
|
201
|
+
## Contributing
|
|
202
|
+
|
|
203
|
+
Read [CONTRIBUTING.md](CONTRIBUTING.md) before you open a pull request. Run `npm test` on Node 24 first. Every commit must carry a `Signed-off-by` line (`git commit -s`), certifying the [Developer Certificate of Origin](https://developercertificate.org). Everyone taking part follows the [Code of Conduct](CODE_OF_CONDUCT.md).
|
|
204
|
+
|
|
205
|
+
## License
|
|
206
|
+
|
|
207
|
+
Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
|
package/bin/parmana-verify.mjs
CHANGED
|
@@ -1,53 +1,53 @@
|
|
|
1
|
-
#!/usr/bin/env node
|
|
2
|
-
// Usage:
|
|
3
|
-
// parmana-verify <proof.json> <trust.json>
|
|
4
|
-
// parmana-verify key-fingerprint <public-key.pem>
|
|
5
|
-
//
|
|
6
|
-
// verify exits 0 = valid, 1 = invalid, 2 = usage or read error.
|
|
7
|
-
// key-fingerprint prints the "sha256:..." value to pin in a trust file.
|
|
8
|
-
|
|
9
|
-
import { readFileSync } from "node:fs";
|
|
10
|
-
import { verifyExecutionTrustRecord } from "../src/verify.mjs";
|
|
11
|
-
import { keyFingerprint, parseTrustPolicy } from "../src/trust.mjs";
|
|
12
|
-
|
|
13
|
-
const args = process.argv.slice(2);
|
|
14
|
-
const USAGE = "usage: parmana-verify <proof.json> <trust.json>\n parmana-verify key-fingerprint <public-key.pem>";
|
|
15
|
-
|
|
16
|
-
if (args[0] === "key-fingerprint") {
|
|
17
|
-
if (args.length !== 2) {
|
|
18
|
-
console.error(USAGE);
|
|
19
|
-
process.exit(2);
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
try {
|
|
23
|
-
console.log(keyFingerprint(readFileSync(args[1], "utf8")));
|
|
24
|
-
process.exit(0);
|
|
25
|
-
} catch (error) {
|
|
26
|
-
console.error(`key error: ${error.message}`);
|
|
27
|
-
process.exit(2);
|
|
28
|
-
}
|
|
29
|
-
}
|
|
30
|
-
|
|
31
|
-
const [proofPath, trustPath] = args;
|
|
32
|
-
|
|
33
|
-
if (!proofPath || !trustPath || args.length !== 2) {
|
|
34
|
-
console.error(USAGE);
|
|
35
|
-
process.exit(2);
|
|
36
|
-
}
|
|
37
|
-
|
|
38
|
-
let proof;
|
|
39
|
-
let policy;
|
|
40
|
-
|
|
41
|
-
try {
|
|
42
|
-
proof = JSON.parse(readFileSync(proofPath, "utf8"));
|
|
43
|
-
policy = parseTrustPolicy(JSON.parse(readFileSync(trustPath, "utf8")));
|
|
44
|
-
} catch (error) {
|
|
45
|
-
console.error(`read error: ${error.message}`);
|
|
46
|
-
process.exit(2);
|
|
47
|
-
}
|
|
48
|
-
|
|
49
|
-
const result = verifyExecutionTrustRecord(proof, policy.keys, { hybridRequiredFrom: policy.hybridRequiredFrom ?? undefined });
|
|
50
|
-
|
|
51
|
-
console.log(JSON.stringify(result));
|
|
52
|
-
|
|
53
|
-
process.exit(result.valid ? 0 : 1);
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
// Usage:
|
|
3
|
+
// parmana-verify <proof.json> <trust.json>
|
|
4
|
+
// parmana-verify key-fingerprint <public-key.pem>
|
|
5
|
+
//
|
|
6
|
+
// verify exits 0 = valid, 1 = invalid, 2 = usage or read error.
|
|
7
|
+
// key-fingerprint prints the "sha256:..." value to pin in a trust file.
|
|
8
|
+
|
|
9
|
+
import { readFileSync } from "node:fs";
|
|
10
|
+
import { verifyExecutionTrustRecord } from "../src/verify.mjs";
|
|
11
|
+
import { keyFingerprint, parseTrustPolicy } from "../src/trust.mjs";
|
|
12
|
+
|
|
13
|
+
const args = process.argv.slice(2);
|
|
14
|
+
const USAGE = "usage: parmana-verify <proof.json> <trust.json>\n parmana-verify key-fingerprint <public-key.pem>";
|
|
15
|
+
|
|
16
|
+
if (args[0] === "key-fingerprint") {
|
|
17
|
+
if (args.length !== 2) {
|
|
18
|
+
console.error(USAGE);
|
|
19
|
+
process.exit(2);
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
try {
|
|
23
|
+
console.log(keyFingerprint(readFileSync(args[1], "utf8")));
|
|
24
|
+
process.exit(0);
|
|
25
|
+
} catch (error) {
|
|
26
|
+
console.error(`key error: ${error.message}`);
|
|
27
|
+
process.exit(2);
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
const [proofPath, trustPath] = args;
|
|
32
|
+
|
|
33
|
+
if (!proofPath || !trustPath || args.length !== 2) {
|
|
34
|
+
console.error(USAGE);
|
|
35
|
+
process.exit(2);
|
|
36
|
+
}
|
|
37
|
+
|
|
38
|
+
let proof;
|
|
39
|
+
let policy;
|
|
40
|
+
|
|
41
|
+
try {
|
|
42
|
+
proof = JSON.parse(readFileSync(proofPath, "utf8"));
|
|
43
|
+
policy = parseTrustPolicy(JSON.parse(readFileSync(trustPath, "utf8")));
|
|
44
|
+
} catch (error) {
|
|
45
|
+
console.error(`read error: ${error.message}`);
|
|
46
|
+
process.exit(2);
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
const result = verifyExecutionTrustRecord(proof, policy.keys, { hybridRequiredFrom: policy.hybridRequiredFrom ?? undefined });
|
|
50
|
+
|
|
51
|
+
console.log(JSON.stringify(result));
|
|
52
|
+
|
|
53
|
+
process.exit(result.valid ? 0 : 1);
|
package/package.json
CHANGED
|
@@ -1,40 +1,40 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@parmana/verifier",
|
|
3
|
-
"version": "
|
|
4
|
-
"description": "Offline verifier for Parmana Execution Trust Records.",
|
|
5
|
-
"license": "Apache-2.0",
|
|
6
|
-
"type": "module",
|
|
7
|
-
"bin": {
|
|
8
|
-
"parmana-verify": "bin/parmana-verify.mjs"
|
|
9
|
-
},
|
|
10
|
-
"files": [
|
|
11
|
-
"bin",
|
|
12
|
-
"src",
|
|
13
|
-
"LICENSE",
|
|
14
|
-
"NOTICE"
|
|
15
|
-
],
|
|
16
|
-
"scripts": {
|
|
17
|
-
"test": "node --test test/verify.test.mjs test/hybrid.test.mjs test/trust.test.mjs test/vectors.test.mjs test/whole-record.test.mjs",
|
|
18
|
-
"examples": "node examples/run-all.mjs"
|
|
19
|
-
},
|
|
20
|
-
"engines": {
|
|
21
|
-
"node": ">=24"
|
|
22
|
-
},
|
|
23
|
-
"repository": {
|
|
24
|
-
"type": "git",
|
|
25
|
-
"url": "git+https://github.com/pavancharak/parmana-verifier.git"
|
|
26
|
-
},
|
|
27
|
-
"homepage": "https://github.com/pavancharak/parmana-verifier#readme",
|
|
28
|
-
"bugs": {
|
|
29
|
-
"url": "https://github.com/pavancharak/parmana-verifier/issues"
|
|
30
|
-
},
|
|
31
|
-
"keywords": [
|
|
32
|
-
"parmana",
|
|
33
|
-
"verifier",
|
|
34
|
-
"execution-trust-record",
|
|
35
|
-
"ed25519",
|
|
36
|
-
"ml-dsa",
|
|
37
|
-
"post-quantum",
|
|
38
|
-
"offline"
|
|
39
|
-
]
|
|
40
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@parmana/verifier",
|
|
3
|
+
"version": "1.6.2",
|
|
4
|
+
"description": "Offline verifier for Parmana Execution Trust Records.",
|
|
5
|
+
"license": "Apache-2.0",
|
|
6
|
+
"type": "module",
|
|
7
|
+
"bin": {
|
|
8
|
+
"parmana-verify": "bin/parmana-verify.mjs"
|
|
9
|
+
},
|
|
10
|
+
"files": [
|
|
11
|
+
"bin",
|
|
12
|
+
"src",
|
|
13
|
+
"LICENSE",
|
|
14
|
+
"NOTICE"
|
|
15
|
+
],
|
|
16
|
+
"scripts": {
|
|
17
|
+
"test": "node --test test/verify.test.mjs test/hybrid.test.mjs test/trust.test.mjs test/vectors.test.mjs test/whole-record.test.mjs",
|
|
18
|
+
"examples": "node examples/run-all.mjs"
|
|
19
|
+
},
|
|
20
|
+
"engines": {
|
|
21
|
+
"node": ">=24"
|
|
22
|
+
},
|
|
23
|
+
"repository": {
|
|
24
|
+
"type": "git",
|
|
25
|
+
"url": "git+https://github.com/pavancharak/parmana-verifier.git"
|
|
26
|
+
},
|
|
27
|
+
"homepage": "https://github.com/pavancharak/parmana-verifier#readme",
|
|
28
|
+
"bugs": {
|
|
29
|
+
"url": "https://github.com/pavancharak/parmana-verifier/issues"
|
|
30
|
+
},
|
|
31
|
+
"keywords": [
|
|
32
|
+
"parmana",
|
|
33
|
+
"verifier",
|
|
34
|
+
"execution-trust-record",
|
|
35
|
+
"ed25519",
|
|
36
|
+
"ml-dsa",
|
|
37
|
+
"post-quantum",
|
|
38
|
+
"offline"
|
|
39
|
+
]
|
|
40
|
+
}
|
package/src/canonical.mjs
CHANGED
|
@@ -1,35 +1,35 @@
|
|
|
1
|
-
// Canonical serialization for Parmana artifacts.
|
|
2
|
-
//
|
|
3
|
-
// Object keys are sorted in code-unit order, arrays keep their order, and the
|
|
4
|
-
// result is UTF-8 encoded JSON. Every hash and signature is computed over
|
|
5
|
-
// these bytes, so the verifier must produce exactly the same bytes as the
|
|
6
|
-
// signer.
|
|
7
|
-
|
|
8
|
-
export function canonicalBytes(value) {
|
|
9
|
-
return new TextEncoder().encode(JSON.stringify(normalize(value)));
|
|
10
|
-
}
|
|
11
|
-
|
|
12
|
-
function normalize(value) {
|
|
13
|
-
if (value === null || typeof value !== "object") {
|
|
14
|
-
return value;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
if (Array.isArray(value)) {
|
|
18
|
-
return value.map(normalize);
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
const normalized = {};
|
|
22
|
-
|
|
23
|
-
for (const key of Object.keys(value).sort()) {
|
|
24
|
-
// defineProperty, not assignment: a key named "__proto__" must stay an
|
|
25
|
-
// own property so its content is covered by the hash and signature.
|
|
26
|
-
Object.defineProperty(normalized, key, {
|
|
27
|
-
value: normalize(value[key]),
|
|
28
|
-
enumerable: true,
|
|
29
|
-
writable: true,
|
|
30
|
-
configurable: true,
|
|
31
|
-
});
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
return normalized;
|
|
35
|
-
}
|
|
1
|
+
// Canonical serialization for Parmana artifacts.
|
|
2
|
+
//
|
|
3
|
+
// Object keys are sorted in code-unit order, arrays keep their order, and the
|
|
4
|
+
// result is UTF-8 encoded JSON. Every hash and signature is computed over
|
|
5
|
+
// these bytes, so the verifier must produce exactly the same bytes as the
|
|
6
|
+
// signer.
|
|
7
|
+
|
|
8
|
+
export function canonicalBytes(value) {
|
|
9
|
+
return new TextEncoder().encode(JSON.stringify(normalize(value)));
|
|
10
|
+
}
|
|
11
|
+
|
|
12
|
+
function normalize(value) {
|
|
13
|
+
if (value === null || typeof value !== "object") {
|
|
14
|
+
return value;
|
|
15
|
+
}
|
|
16
|
+
|
|
17
|
+
if (Array.isArray(value)) {
|
|
18
|
+
return value.map(normalize);
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
const normalized = {};
|
|
22
|
+
|
|
23
|
+
for (const key of Object.keys(value).sort()) {
|
|
24
|
+
// defineProperty, not assignment: a key named "__proto__" must stay an
|
|
25
|
+
// own property so its content is covered by the hash and signature.
|
|
26
|
+
Object.defineProperty(normalized, key, {
|
|
27
|
+
value: normalize(value[key]),
|
|
28
|
+
enumerable: true,
|
|
29
|
+
writable: true,
|
|
30
|
+
configurable: true,
|
|
31
|
+
});
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
return normalized;
|
|
35
|
+
}
|