npm - @primust/verifier - Versions diffs - 1.3.0 → 1.3.1 - Mend

@primust/verifier 1.3.0 → 1.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -110,18 +110,19 @@ interface VerificationResult {
  */
 declare function verify(artifact: Record<string, unknown>, options?: VerifyOptions, upstreamRootResolver?: UpstreamRootResolver): Promise<VerificationResult>;
-/**
- * verify.html template generator for Evidence Pack output.
- *
- * Generates a self-contained HTML file that:
- * 1. Embeds the Ed25519 public key
- * 2. Pre-loads the Evidence Pack summary
- * 3. Verifies using WebCrypto API on page load
- * 4. Works completely offline
- * 5. Shows chain of VPECs with verification status
- */
 interface VerifyHtmlOptions {
     publicKeyB64: string;
+    /**
+     * SHA-256 fingerprints (lowercase hex of the raw 32-byte Ed25519 public key)
+     * of keys the *reader* trusts as genuine Primust trust anchors. The page only
+     * shows the green "verified by Primust" banner when the embedded key's
+     * fingerprint is on this list. OMITTED → defaults to the pinned Primust
+     * production anchors (PRIMUST_TRUST_ANCHOR_FINGERPRINTS) so genuinely
+     * Primust-signed packs verify green out of the box. Pass an explicit list
+     * (e.g. a BYOK org key confirmed out-of-band) to override; pass [] to trust
+     * no key, forcing the "authenticity unconfirmed" caution for every pack.
+     */
+    trustedKeyFingerprints?: string[];
     packData: {
         pack_id: string;
         org_id: string;

package/dist/index.js CHANGED Viewed

@@ -23,14 +23,53 @@ import {
 } from "./chunk-BWJUVMT7.js";
 // src/verify-html-template.ts
+var PRIMUST_TRUST_ANCHOR_FINGERPRINTS = [
+  "3bc0af2e434432a68a8b2216c4e69165e7456d3f7ba584bf595b30da81e80218",
+  // US
+  "9a582df3ec7e83ddeaa0220cbb2741cb940925f9be09f04b45840fb07481174d"
+  // EU
+];
 function escapeHtml(value) {
   return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 function safePackJson(packData) {
   return JSON.stringify(packData).replace(/</g, "\\u003c");
 }
+function bannerDecision(state) {
+  if (!state.allSigsValid) {
+    return {
+      cls: "status failed",
+      text: "\u2717 NOT VERIFIED \u2014 One or more credential signatures did not match the embedded key"
+    };
+  }
+  if (state.vpecsLength <= 0) {
+    return {
+      cls: "status failed",
+      text: "\u2717 NOT VERIFIED \u2014 this pack contains no credentials; there is nothing to verify"
+    };
+  }
+  if (state.vpecCount !== state.vpecsLength) {
+    return {
+      cls: "status failed",
+      text: "\u2717 NOT VERIFIED \u2014 credential count mismatch: pack declares " + state.vpecCount + " but carries " + state.vpecsLength + ". The pack may have been altered."
+    };
+  }
+  if (state.keyTrusted) {
+    return {
+      cls: "status verified",
+      text: "\u2713 VERIFIED \u2014 All " + state.vpecsLength + " credentials verified against a recognized Primust trust anchor"
+    };
+  }
+  return {
+    cls: "status caution",
+    text: "\u26A0 SIGNATURES CONSISTENT, KEY UNVERIFIED \u2014 all " + state.vpecsLength + " signatures match the embedded key, but that key is not a recognized Primust trust anchor. Confirm the fingerprint above before relying on this result; a self-signed pack reaches this same state."
+  };
+}
 function generateVerifyHtml(options) {
   const { publicKeyB64, packData } = options;
+  const trustedKeyFingerprints = (options.trustedKeyFingerprints ?? PRIMUST_TRUST_ANCHOR_FINGERPRINTS).map(
+    (fp) => String(fp).toLowerCase().replace(/[^0-9a-f]/g, "")
+  );
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -44,8 +83,13 @@ function generateVerifyHtml(options) {
     .subtitle { color: #666; font-size: 0.9rem; margin-bottom: 2rem; }
     .status { padding: 1rem; border-radius: 8px; margin-bottom: 1.5rem; font-weight: 600; font-size: 1.1rem; }
     .status.verified { background: #d4edda; color: #155724; border: 1px solid #c3e6cb; }
+    .status.caution { background: #fff3cd; color: #856404; border: 1px solid #ffeeba; }
     .status.failed { background: #f8d7da; color: #721c24; border: 1px solid #f5c6cb; }
     .status.loading { background: #e2e3e5; color: #383d41; border: 1px solid #d6d8db; }
+    .trust-panel { background: white; border: 1px solid #e0e0e0; border-radius: 8px; padding: 1rem; margin-bottom: 1.5rem; font-size: 0.85rem; }
+    .trust-panel .label { font-size: 0.7rem; color: #888; text-transform: uppercase; letter-spacing: 0.03em; }
+    .trust-panel .fingerprint { font-family: 'SF Mono', Monaco, monospace; font-size: 0.8rem; word-break: break-all; margin-top: 0.2rem; }
+    .trust-panel .disclosure { color: #666; margin-top: 0.6rem; line-height: 1.4; }
     .summary { display: grid; grid-template-columns: repeat(4, 1fr); gap: 1rem; margin-bottom: 1.5rem; }
     .stat { background: white; border: 1px solid #e0e0e0; border-radius: 8px; padding: 1rem; }
     .stat-label { font-size: 0.75rem; color: #888; text-transform: uppercase; }
@@ -71,6 +115,20 @@ function generateVerifyHtml(options) {
   <div id="status" class="status loading">Verifying...</div>
+  <div class="trust-panel">
+    <div class="label">Signing key fingerprint (SHA-256)</div>
+    <div class="fingerprint" id="key-fingerprint">computing\u2026</div>
+    <div class="disclosure" id="trust-disclosure">
+      This page checks each credential's signature against the public key embedded
+      in this file. That proves the credentials are internally consistent with
+      this key \u2014 it does <strong>not</strong>, on its own, prove the key belongs
+      to Primust. Before relying on a "verified" result, confirm the fingerprint
+      above matches Primust's published key at
+      <code>https://keys.primust.com/.well-known/primust-pubkeys/</code>, or use
+      <code>pip install primust-verify</code> (which only trusts that host).
+    </div>
+  </div>
   <div class="summary">
     <div class="stat">
       <div class="stat-label">VPECs</div>
@@ -113,11 +171,29 @@ function generateVerifyHtml(options) {
   <script>
     const PRIMUST_PUBLIC_KEY_B64 = "${escapeHtml(publicKeyB64)}";
+    // Fingerprints of keys the reader trusts as genuine Primust trust anchors.
+    // Empty by default \u2014 see the trust-model note in verify-html-template.ts.
+    const TRUSTED_KEY_FINGERPRINTS = ${safePackJson(trustedKeyFingerprints)};
     const PACK_DATA = ${safePackJson(packData)};
+    function toHex(buf) {
+      return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
+    }
+    // Banner verdict logic \u2014 embedded verbatim from verify-html-template.ts so
+    // the page runs the exact function the test suite verifies behaviorally.
+    const bannerDecision = ${bannerDecision.toString()};
     async function importKey(b64) {
-      const raw = Uint8Array.from(atob(b64), c => c.charCodeAt(0));
-      return crypto.subtle.importKey('raw', raw, { name: 'Ed25519' }, false, ['verify']);
+      // Accept base64 OR base64url (the JWKS 'x' field / SDK embeds base64url),
+      // so atob always yields the raw 32-byte key and the fingerprint is
+      // canonical (== sha256 of the raw key, matching the pinned anchors).
+      const std = String(b64).replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, '');
+      const padded = std + '='.repeat((4 - (std.length % 4)) % 4);
+      const raw = Uint8Array.from(atob(padded), c => c.charCodeAt(0));
+      const fingerprint = toHex(await crypto.subtle.digest('SHA-256', raw));
+      const key = await crypto.subtle.importKey('raw', raw, { name: 'Ed25519' }, false, ['verify']);
+      return { key, fingerprint };
     }
     async function verifySignature(key, signatureHex, payloadStr) {
@@ -132,7 +208,10 @@ function generateVerifyHtml(options) {
       let allValid = true;
       try {
-        const key = await importKey(PRIMUST_PUBLIC_KEY_B64);
+        const { key, fingerprint } = await importKey(PRIMUST_PUBLIC_KEY_B64);
+        const fpEl = document.getElementById('key-fingerprint');
+        if (fpEl) fpEl.textContent = fingerprint;
+        const keyTrusted = TRUSTED_KEY_FINGERPRINTS.indexOf(fingerprint) !== -1;
         for (const vpec of PACK_DATA.vpecs) {
           let valid = false;
@@ -148,8 +227,10 @@ function generateVerifyHtml(options) {
           const statusTd = document.createElement('td');
           const statusBadge = document.createElement('span');
+          // Row badge reports signature-vs-embedded-key only. Whether that key
+          // is a genuine Primust anchor is the pack-level verdict in the banner.
           statusBadge.className = 'badge ' + (valid ? 'badge-pass' : 'badge-fail');
-          statusBadge.textContent = valid ? 'VERIFIED' : 'NOT VERIFIED';
+          statusBadge.textContent = valid ? 'SIG OK' : 'SIG INVALID';
           statusTd.appendChild(statusBadge);
           row.appendChild(statusTd);
@@ -200,7 +281,7 @@ function generateVerifyHtml(options) {
             const badge = document.createElement('span');
             badge.className = 'badge ' + (uvValid ? 'badge-pass' : 'badge-fail');
-            badge.textContent = uvValid ? 'VERIFIED' : 'NOT VERIFIED';
+            badge.textContent = uvValid ? 'SIG OK' : 'SIG INVALID';
             node.appendChild(badge);
             node.appendChild(document.createTextNode(' '));
@@ -240,10 +321,18 @@ function generateVerifyHtml(options) {
           container.appendChild(currentNode);
         }
-        statusEl.className = 'status ' + (allValid ? 'verified' : 'failed');
-        statusEl.textContent = allValid
-          ? '\\u2713 VERIFIED \u2014 All ' + PACK_DATA.vpecs.length + ' credentials verified'
-          : '\\u2717 NOT VERIFIED \u2014 Some credentials failed verification';
+        // Verdict: green requires valid sigs AND a recognized trust anchor AND
+        // a non-empty, count-consistent credential set. A consistent-but-
+        // unrecognized key (self-signed pack) \u2192 amber caution; empty/altered
+        // packs \u2192 failed. See bannerDecision() in verify-html-template.ts.
+        const verdict = bannerDecision({
+          allSigsValid: allValid,
+          keyTrusted: keyTrusted,
+          vpecCount: PACK_DATA.vpec_count,
+          vpecsLength: PACK_DATA.vpecs.length,
+        });
+        statusEl.className = verdict.cls;
+        statusEl.textContent = verdict.text;
       } catch (e) {
         statusEl.className = 'status failed';
         statusEl.textContent = 'Verification error: ' + e.message;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@primust/verifier",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Offline and CLI verifier for Primust Governed-Execution Credentials. Free forever. No account required.",
   "homepage": "https://primust.com",
   "repository": {