@thurinlabs/identity-kit 1.0.1 → 1.0.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Thurin Labs LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -264,6 +264,14 @@ The card talks directly to Ethereum and each proof platform — no intermediary,
 | Codeberg | Repository description |
 | Mastodon | Profile metadata |
 
+## How a claim is verified
+
+`verifyAttestation` checks three things: the stored key's fingerprint is the one on the claim; the stored clearsigned statement was made by that key (or one of its bound signing subkeys) and has not been altered; and the statement names the claim's address. Key validity is judged **now**, the way gpg does it: the key must currently be bound, unrevoked, and unexpired. It is deliberately not judged at the instant the signature was made, which is openpgp.js's default. That default rejects a perfectly good claim whenever the key's newest self-certification postdates the attest signature, which is exactly what happens when you add a proof after attesting and export with `export-minimal` (1.0.3).
+
+## Key algorithms
+
+Any curve openpgp.js can compute is accepted: Ed25519, Cv25519, NIST P-256/384/521, brainpool, RSA, and **secp256k1**. openpgp.js rejects secp256k1 by default because RFC 9580 does not list it; identity-kit turns that rejection off, since it is a compatibility rule, not a security one. A secp256k1 PGP key doubles as an Ethereum key (the address is derived from the same public point), so anything that can sign with the PGP key can sign Ethereum transactions: hold such a key if you like, but do not fund its derived address. In Node, openpgp.js needs the `eckey-utils` package for this curve; identity-kit depends on it, so `npm install` brings it in. The browser build needs nothing extra.
+
 ## Migrating from 0.9.x
 
 1.0.0 reads the **PGPRegistry v2** contract. The v1 registry is no longer read.

package/dist/embed.global.js

@@ -31148,6 +31148,9 @@ ${prettyStateOverride(stateOverride)}`;
   }
 
   // src/core/pgp.ts
+  function pgpConfig(openpgp) {
+    return { ...openpgp.config, rejectCurves: /* @__PURE__ */ new Set() };
+  }
   function algorithmName(keyOrSubkey) {
     try {
       const info = keyOrSubkey.getAlgorithmInfo();
@@ -31169,7 +31172,9 @@ ${prettyStateOverride(stateOverride)}`;
   }
   async function parsePgpKey(armoredKey) {
     try {
-      const { readKey } = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const openpgp = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const { readKey } = openpgp;
+      const config = pgpConfig(openpgp);
       const key = await readKey({ armoredKey });
       const fingerprint = key.getFingerprint().toUpperCase();
       const algorithm = algorithmName(key);
@@ -31188,7 +31193,12 @@ ${prettyStateOverride(stateOverride)}`;
             await cert.verify(
               key.keyPacket,
               cert.signatureType,
-              { userID: user.userID, key: key.keyPacket }
+              { userID: user.userID, key: key.keyPacket },
+              void 0,
+              // date: now
+              void 0,
+              // detached
+              config
             );
           } catch {
             continue;
@@ -31232,15 +31242,28 @@ ${prettyStateOverride(stateOverride)}`;
       if (!pgpPublicKey || !pgpSignature) {
         return { verified: false, reason: "Missing PGP data" };
       }
-      const { readKey, readCleartextMessage, verify } = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const openpgp = await Promise.resolve().then(() => (init_openpgp_min(), openpgp_min_exports));
+      const { readKey, readCleartextMessage, LiteralDataPacket } = openpgp;
+      const config = pgpConfig(openpgp);
       const publicKey = await readKey({ armoredKey: pgpPublicKey });
       const keyFingerprint = publicKey.getFingerprint().toUpperCase();
       if (keyFingerprint !== fingerprint.toUpperCase()) {
         return { verified: false, reason: "Key fingerprint mismatch" };
       }
       const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-      const { signatures } = await verify({ message, verificationKeys: publicKey });
-      await signatures[0].verified;
+      const msg = message;
+      const now = /* @__PURE__ */ new Date();
+      let signed2 = false;
+      for (const sig of msg.signature.packets) {
+        if (!publicKey.getKeys(sig.issuerKeyID).length) continue;
+        const signingKey = await publicKey.getSigningKey(sig.issuerKeyID, now, void 0, config);
+        const literal = new LiteralDataPacket();
+        literal.setText(msg.text ?? message.getText().replace(/\r?\n/g, "\r\n"));
+        await sig.verify(signingKey.keyPacket, sig.signatureType, literal, now, true, config);
+        signed2 = true;
+        break;
+      }
+      if (!signed2) return { verified: false, reason: "Message is not signed by this key" };
       const signedText = message.getText();
       if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
         return { verified: false, reason: "Signed message does not contain ETH address" };