@smartledger/bsv 9.20.0 → 9.21.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +52 -0
- package/README.md +19 -19
- package/bsv-gdaf.min.js +1 -1
- package/bsv-smartcontract.min.js +1 -1
- package/bsv.bundle.js +2 -2
- package/bsv.min.js +2 -2
- package/docs/AUDIT_SCOPE.md +6 -6
- package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
- package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
- package/docs/audit-rfq/cure53.txt +1 -1
- package/docs/audit-rfq/ncc-group.txt +1 -1
- package/docs/audit-rfq/trail-of-bits.txt +1 -1
- package/docs/getting-started/INSTALLATION.md +23 -23
- package/docs/getting-started/QUICK_START.md +7 -7
- package/docs/migration/FROM_BSV_1_5_6.md +5 -5
- package/lib/notaryhash/index.js +32 -0
- package/package.json +1 -1
- package/version.js +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
7
7
|
|
|
8
8
|
## [Unreleased]
|
|
9
9
|
|
|
10
|
+
## [9.21.0] - 2026-10-05
|
|
11
|
+
|
|
12
|
+
### Added — `opts.network` on `NotaryHash.verify`, opt-in
|
|
13
|
+
|
|
14
|
+
`anchor.network` is the last field in a certificate that no signature covers. A mainnet certificate
|
|
15
|
+
relabelled `"bsv-testnet"` verified, and so did one relabelled `"not-a-chain"`.
|
|
16
|
+
|
|
17
|
+
BRC-220 calls the field descriptive — the headers decide the chain, not the label — so accepting
|
|
18
|
+
any value is conformant, and this check is therefore **opt-in**: a default would break every
|
|
19
|
+
testnet caller for no gain. Pass `opts.network` and a certificate naming another chain is refused
|
|
20
|
+
by name; omit it and nothing changes.
|
|
21
|
+
|
|
22
|
+
Worth exactly what it claims: **it compares a label against the caller's own setting, and proves
|
|
23
|
+
nothing about which chain the header source serves.** A caller who needs that must obtain headers
|
|
24
|
+
from a source it trusts for the chain it means — the same reason this library never fetches one.
|
|
25
|
+
|
|
26
|
+
Raised by the NotaryHash SDK session after a third session relabelled a mainnet certificate and
|
|
27
|
+
both verifiers accepted it. Their verifier takes the same option, so the two agree.
|
|
28
|
+
|
|
29
|
+
### Documented — 8.3.1 was a signature-convention break, and it orphaned certificates
|
|
30
|
+
|
|
31
|
+
**If you anchored NotaryHash certificates with 8.3.0, some of them can no longer be verified by any
|
|
32
|
+
later version, and there was no symptom until the fix landed.**
|
|
33
|
+
|
|
34
|
+
8.3.0 reversed the payload digest in **both** the signer and the verifier. The two cancelled, so
|
|
35
|
+
certificates it produced verified perfectly under 8.3.0. 8.3.1 corrected both halves at once —
|
|
36
|
+
which was right — and in doing so made every 8.3.0-signed certificate unverifiable, because the
|
|
37
|
+
signature is genuinely over `reverse(payloadHash)`.
|
|
38
|
+
|
|
39
|
+
Measured on five mainnet certificates, three library versions, nothing else changed:
|
|
40
|
+
|
|
41
|
+
| | 8.3.0 | 8.3.1 | 9.18–9.21 |
|
|
42
|
+
|---|---|---|---|
|
|
43
|
+
| four certificates signed 2026-08-16 | **verify** | fail | fail |
|
|
44
|
+
| one control signed 2026-08-20 | fail | **verify** | **verify** |
|
|
45
|
+
|
|
46
|
+
The two eras are mutually unverifiable, which is only possible if both sides of 8.3.0 reversed.
|
|
47
|
+
Confirmed four ways: in Python with no SDK, through `NotaryHash.verify`, through
|
|
48
|
+
`crypto.ECDSA.verify` directly, and here against the reporter's committed fixture — the four
|
|
49
|
+
failing certificates verify over `reverse(payloadHash)` and not over `payloadHash`, and the control
|
|
50
|
+
is the exact inverse.
|
|
51
|
+
|
|
52
|
+
**No reversing path will be added.** Accepting two derivations of one value is how the 8.3.0–9.8.0
|
|
53
|
+
certificate-format split happened, and a compatibility mode would reintroduce it. These
|
|
54
|
+
certificates also cannot be rescued by re-anchoring: the signature does not survive, so the key
|
|
55
|
+
holder would have to sign again — a new statement made today, not a restoration of an old one. The
|
|
56
|
+
remedy is to label them with the version that verifies them.
|
|
57
|
+
|
|
58
|
+
Recorded because the general shape is worth more than the incident: **a convention that is wrong
|
|
59
|
+
but self-consistent leaves no symptom until the day it is corrected.** Reported and measured by the
|
|
60
|
+
ordinals session that holds the affected certificates.
|
|
61
|
+
|
|
10
62
|
## [9.20.0] - 2026-10-05
|
|
11
63
|
|
|
12
64
|
A security release. One verifier accepted a forged proof outright; another accepted eight tampered
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
Bitcoin SV library with an interpreter-verified script engine.
|
|
4
4
|
|
|
5
|
-
[](https://www.npmjs.com/package/@smartledger/bsv)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
[](STABILITY.md)
|
|
8
8
|
|
|
@@ -155,44 +155,44 @@ const bsv = require('@smartledger/bsv') // 128 modules
|
|
|
155
155
|
### **Core Modules**
|
|
156
156
|
| Module | Size | Use Case | CDN |
|
|
157
157
|
|--------|------|----------|-----|
|
|
158
|
-
| **bsv.min.js** |
|
|
159
|
-
| **bsv.bundle.js** |
|
|
158
|
+
| **bsv.min.js** | 1069KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js` |
|
|
159
|
+
| **bsv.bundle.js** | 1069KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.21.0/bsv.bundle.js` |
|
|
160
160
|
|
|
161
161
|
### **W3C Verifiable Credentials**
|
|
162
162
|
| Module | Size | Use Case | CDN |
|
|
163
163
|
|--------|------|----------|-----|
|
|
164
|
-
| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.
|
|
165
|
-
| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.
|
|
166
|
-
| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.
|
|
167
|
-
| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.
|
|
164
|
+
| **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-didweb.min.js` |
|
|
165
|
+
| **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-vcjwt.min.js` |
|
|
166
|
+
| **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-statuslist.min.js` |
|
|
167
|
+
| **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.21.0/bsv-anchor.min.js` |
|
|
168
168
|
|
|
169
169
|
### **Smart Contract & Development**
|
|
170
170
|
| Module | Size | Use Case | CDN |
|
|
171
171
|
|--------|------|----------|-----|
|
|
172
|
-
| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.
|
|
173
|
-
| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.
|
|
174
|
-
| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.
|
|
175
|
-
| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.
|
|
172
|
+
| **bsv-smartcontract.min.js** | 141KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.21.0/bsv-smartcontract.min.js` |
|
|
173
|
+
| **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.21.0/bsv-covenant.min.js` |
|
|
174
|
+
| **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.21.0/bsv-script-helper.min.js` |
|
|
175
|
+
| **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.21.0/bsv-security.min.js` |
|
|
176
176
|
|
|
177
177
|
### **Legal & Compliance**
|
|
178
178
|
| Module | Size | Use Case | CDN |
|
|
179
179
|
|--------|------|----------|-----|
|
|
180
|
-
| **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.
|
|
181
|
-
| **bsv-gdaf.min.js** |
|
|
180
|
+
| **bsv-ltp.min.js** | 544KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.21.0/bsv-ltp.min.js` |
|
|
181
|
+
| **bsv-gdaf.min.js** | 1069KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.21.0/bsv-gdaf.min.js` |
|
|
182
182
|
|
|
183
183
|
### **Advanced Cryptography**
|
|
184
184
|
| Module | Size | Use Case | CDN |
|
|
185
185
|
|--------|------|----------|-----|
|
|
186
|
-
| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.
|
|
186
|
+
| **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.21.0/bsv-shamir.min.js` |
|
|
187
187
|
|
|
188
188
|
### **Utilities**
|
|
189
189
|
| Module | Size | Use Case | CDN |
|
|
190
190
|
|--------|------|----------|-----|
|
|
191
|
-
| **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.
|
|
192
|
-
| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.
|
|
193
|
-
| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.
|
|
191
|
+
| **bsv-ecies.min.js** | 139KB | Encryption | `unpkg.com/@smartledger/bsv@9.21.0/bsv-ecies.min.js` |
|
|
192
|
+
| **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.21.0/bsv-message.min.js` |
|
|
193
|
+
| **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.21.0/bsv-mnemonic.min.js` |
|
|
194
194
|
```html
|
|
195
|
-
<script src="https://unpkg.com/@smartledger/bsv@9.
|
|
195
|
+
<script src="https://unpkg.com/@smartledger/bsv@9.21.0/bsv.min.js"></script>
|
|
196
196
|
<script>
|
|
197
197
|
const key = bsv.PrivateKey.fromRandom()
|
|
198
198
|
</script>
|
|
@@ -240,4 +240,4 @@ MIT
|
|
|
240
240
|
|
|
241
241
|
---
|
|
242
242
|
|
|
243
|
-
**SmartLedger-BSV v9.
|
|
243
|
+
**SmartLedger-BSV v9.21.0**
|