kxco-post-quantum 1.7.0 → 1.7.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.7.1
+
+Release integrity. No source change to the library.
+
+Release assets are now signed with ML-DSA-65 through this package's own signing
+path, and each release carries a SLSA provenance file. Until now the npm tarball
+had provenance and the GitHub release, where the evidence bundle is actually
+downloaded from, had neither a signature nor a statement of where it was built.
+
+The public key is committed as release-signing-key.pub.hex and published with
+each release. The signing script refuses to run if the seed in CI stops deriving
+that key, and verifies every signature immediately after producing it.
+
 ## 1.7.0
 
 Additive. No existing export changes shape, no wire format moves, and the

package/README.md

@@ -344,3 +344,29 @@ Apache-2.0. See [LICENSE](./LICENSE).
 ## Maintainers
 
 Shayne Heffernan and John Heffernan — [KXCO by Knightsbridge](https://kxco.ai)
+
+## Verifying a release
+
+Every release asset is signed with ML-DSA-65 by this package's own signing path,
+and carries a SLSA provenance file recording the workflow that built it.
+
+```
+manifest-node24.x.json          the bundle's manifest
+evidence-node24.x.zip           the bundle
+evidence-node24.x.zip.sig       ML-DSA-65 signature over the zip, hex
+evidence.intoto.jsonl           SLSA provenance
+release-signing-key.pub.hex     the public key, also committed to this repository
+```
+
+```js
+import { readFileSync } from 'node:fs'
+import { mlDsa } from 'kxco-post-quantum'
+
+const pub = Buffer.from(readFileSync('release-signing-key.pub.hex', 'utf8').trim(), 'hex')
+const sig = readFileSync('evidence-node24.x.zip.sig', 'utf8').trim()
+mlDsa.verify(pub, readFileSync('evidence-node24.x.zip'), sig)   // true
+```
+
+Compare the public key against the copy in this repository before trusting a
+signature: a key served alongside the artefact it signs proves only that the
+same party produced both.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-post-quantum",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "ML-DSA-65, ML-KEM-768 and SLH-DSA-SHA2-192s with key fingerprinting. OpenSSL 3.5 primitives on Node 24+, JavaScript elsewhere. 2,103 NIST ACVP vectors: 1,793 passed, 0 failed, 310 skipped. 225 interop checks, 0 failed. Reproducible builds and provenance.",
   "keywords": [
     "post-quantum",