@treeship/verify 0.31.10 → 0.31.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -6
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -32,23 +32,27 @@ if (result.outcome === 'pass') {
|
|
|
32
32
|
}
|
|
33
33
|
```
|
|
34
34
|
|
|
35
|
-
### `verifyCertificate(target, now?)`
|
|
35
|
+
### `verifyCertificate(target, now?, trustRoots?)`
|
|
36
36
|
|
|
37
|
-
Verifies the Ed25519 signature on an Agent Certificate against the public key
|
|
37
|
+
Verifies the Ed25519 signature on an Agent Certificate against a trust root the caller pins via `trustRoots` -- as of the v0.10.3 trust-root audit fix, the certificate's own embedded public key is never trusted on its own; that would make every certificate self-signed. `trustRoots` is required for the signature to be accepted; omit it to get a deliberate fail-closed result for diagnostic UIs. With `now` supplied (Date or RFC 3339 string), also classifies the validity window.
|
|
38
38
|
|
|
39
39
|
```typescript
|
|
40
40
|
import { verifyCertificate } from '@treeship/verify';
|
|
41
41
|
|
|
42
|
-
const result = await verifyCertificate(
|
|
42
|
+
const result = await verifyCertificate(
|
|
43
|
+
'./researcher.agent/certificate.json',
|
|
44
|
+
new Date(),
|
|
45
|
+
trustRootsJson, // e.g. the contents of ~/.treeship/trust_roots.json
|
|
46
|
+
);
|
|
43
47
|
|
|
44
48
|
if (result.outcome === 'pass' && result.validity === 'valid') {
|
|
45
49
|
console.log(`certificate valid for ${result.certificate.agent_name}`);
|
|
46
50
|
}
|
|
47
51
|
```
|
|
48
52
|
|
|
49
|
-
### `crossVerify(receipt, certificate, now?)`
|
|
53
|
+
### `crossVerify(receipt, certificate, now?, trustRoots?)`
|
|
50
54
|
|
|
51
|
-
Answers three questions: do the receipt and certificate reference the same ship, was the certificate valid at `now`, was every tool the session called authorized by the certificate. The `ok` field is the roll-up.
|
|
55
|
+
Answers three questions: do the receipt and certificate reference the same ship, was the certificate valid at `now`, was every tool the session called authorized by the certificate. The `ok` field is the roll-up. Like `verifyCertificate`, the certificate's signature is only accepted against a pinned `trustRoots` set -- omit it for a deliberate fail-closed result.
|
|
52
56
|
|
|
53
57
|
```typescript
|
|
54
58
|
import { crossVerify } from '@treeship/verify';
|
|
@@ -56,6 +60,8 @@ import { crossVerify } from '@treeship/verify';
|
|
|
56
60
|
const result = await crossVerify(
|
|
57
61
|
'https://treeship.dev/receipt/ssn_abc',
|
|
58
62
|
'https://example.com/researcher.agent.json',
|
|
63
|
+
new Date(),
|
|
64
|
+
trustRootsJson,
|
|
59
65
|
);
|
|
60
66
|
|
|
61
67
|
if (result.ok) {
|
|
@@ -166,7 +172,7 @@ renderChecks(result.checks);
|
|
|
166
172
|
## What this package is NOT
|
|
167
173
|
|
|
168
174
|
- **Not an attestation SDK.** For signing artifacts, session management, Hub push/pull, or agent registration, use [`@treeship/sdk`](../sdk-ts/) which shells out to the `treeship` CLI.
|
|
169
|
-
- **Not a trust anchor.**
|
|
175
|
+
- **Not a trust anchor.** `verifyCertificate` checks the embedded Ed25519 signature against a `trustRoots` set the caller pins and passes in -- not against the certificate's own embedded key, which would make every certificate self-signed. Deciding *which* roots to trust, and chaining further to an issuer, is the caller's responsibility.
|
|
170
176
|
- **Not a drop-in for local-chain verification.** Some signature verification needs the original envelope bytes, which a URL-fetched receipt does not carry. Use `treeship verify <artifact-id>` on the CLI for that.
|
|
171
177
|
|
|
172
178
|
## License
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@treeship/verify",
|
|
3
|
-
"version": "0.31.
|
|
3
|
+
"version": "0.31.11",
|
|
4
4
|
"description": "Zero-dependency cryptographic verification for Treeship receipts and certificates. Runs anywhere WASM runs: Node, browser, Vercel Edge, Cloudflare Workers, AWS Lambda.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -40,7 +40,7 @@
|
|
|
40
40
|
"test": "vitest run"
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
|
-
"@treeship/core-wasm": "0.31.
|
|
43
|
+
"@treeship/core-wasm": "0.31.11"
|
|
44
44
|
},
|
|
45
45
|
"devDependencies": {
|
|
46
46
|
"@types/node": "^25.5.0",
|