@thurinlabs/identity-kit 1.0.0 → 1.0.2

package/README.md

@@ -258,12 +258,16 @@ The card talks directly to Ethereum and each proof platform — no intermediary,
 
 | Provider | Proof Method |
 |----------|-------------|
-| GitHub | Public gist |
+| GitHub | Public gist, or a repository description (the form an organisation can use) |
 | DNS | TXT record |
 | Farcaster | Public cast (requires Neynar API key) |
 | Codeberg | Repository description |
 | Mastodon | Profile metadata |
 
+## Key algorithms
+
+Any curve openpgp.js can compute is accepted: Ed25519, Cv25519, NIST P-256/384/521, brainpool, RSA, and **secp256k1**. openpgp.js rejects secp256k1 by default because RFC 9580 does not list it; identity-kit turns that rejection off, since it is a compatibility rule, not a security one. A secp256k1 PGP key doubles as an Ethereum key (the address is derived from the same public point), so anything that can sign with the PGP key can sign Ethereum transactions: hold such a key if you like, but do not fund its derived address. In Node, openpgp.js needs the `eckey-utils` package for this curve; identity-kit depends on it, so `npm install` brings it in. The browser build needs nothing extra.
+
 ## Migrating from 0.9.x
 
 1.0.0 reads the **PGPRegistry v2** contract. The v1 registry is no longer read.

package/dist/embed.global.js

@@ -31148,6 +31148,7 @@ ${prettyStateOverride(stateOverride)}`;
   }
 
   // src/core/pgp.ts
+  var PGP_CONFIG = { rejectCurves: /* @__PURE__ */ new Set() };
   function algorithmName(keyOrSubkey) {
     try {
       const info = keyOrSubkey.getAlgorithmInfo();
@@ -31188,7 +31189,9 @@ ${prettyStateOverride(stateOverride)}`;
             await cert.verify(
               key.keyPacket,
               cert.signatureType,
-              { userID: user.userID, key: key.keyPacket }
+              { userID: user.userID, key: key.keyPacket },
+              void 0,
+              PGP_CONFIG
             );
           } catch {
             continue;
@@ -31239,7 +31242,7 @@ ${prettyStateOverride(stateOverride)}`;
         return { verified: false, reason: "Key fingerprint mismatch" };
       }
       const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-      const { signatures } = await verify({ message, verificationKeys: publicKey });
+      const { signatures } = await verify({ message, verificationKeys: publicKey, config: PGP_CONFIG });
       await signatures[0].verified;
       const signedText = message.getText();
       if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
@@ -31376,6 +31379,14 @@ ${prettyStateOverride(stateOverride)}`;
       pattern: /^https:\/\/gist\.github\.com\/([^/]+)\/([a-f0-9]+)$/i,
       parse: (m2) => ({ user: m2[1], gistId: m2[2] })
     },
+    {
+      // A repository's description — the form an organisation can use, since
+      // gists belong to user accounts only. Same shape as the Codeberg proof.
+      provider: "github",
+      label: "GitHub",
+      pattern: /^https:\/\/github\.com\/([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/i,
+      parse: (m2) => ({ user: m2[1], repo: m2[2] })
+    },
     {
       provider: "dns",
       label: "DNS",
@@ -31447,6 +31458,7 @@ ${prettyStateOverride(stateOverride)}`;
     return text.toUpperCase().includes(fingerprint.toUpperCase());
   }
   async function verifyGitHub(proof, fingerprint) {
+    if (proof.repo) return verifyGitHubRepo(proof, fingerprint);
     try {
       const resp = await fetch(`https://api.github.com/gists/${proof.gistId}`);
       if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
@@ -31464,6 +31476,24 @@ ${prettyStateOverride(stateOverride)}`;
       return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
     }
   }
+  async function verifyGitHubRepo(proof, fingerprint) {
+    try {
+      const resp = await fetch(
+        `https://api.github.com/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
+      );
+      if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
+      const data = await resp.json();
+      if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+        return { verified: false, reason: "Repository owner does not match claimed account" };
+      }
+      if (data.description && containsFingerprint(data.description, fingerprint)) {
+        return { verified: true };
+      }
+      return { verified: false, reason: "Fingerprint token not found in repository description" };
+    } catch (err) {
+      return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+    }
+  }
   async function verifyDNS(proof, fingerprint) {
     try {
       const resp = await fetch(