kxco-post-quantum 1.7.5 → 1.7.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +19 -0
  2. package/LICENCE-PRODUCT.md +2 -2
  3. package/NOTICE +6 -0
  4. package/README.md +2 -2
  5. package/package.json +2 -2
package/CHANGELOG.md CHANGED
@@ -1,5 +1,24 @@
1
1
  # Changelog
2
2
 
3
+ ## 1.7.7
4
+
5
+ Documentation. No source change.
6
+
7
+ A NOTICE file names the copyright owner, Knightsbridge Financial Ltd, trading
8
+ as KXCO, and ships in the package, so anyone who redistributes it carries the
9
+ attribution, as section 4(d) of the Apache License requires.
10
+
11
+ LICENCE-PRODUCT.md dates SLSA provenance from 1.4.0, the first release that
12
+ carries it, and gives admin@kxco.ai for commercial terms.
13
+
14
+ ## 1.7.6
15
+
16
+ Documentation. No source change.
17
+
18
+ The release-integrity lines now name the version that SLSA provenance and
19
+ the CycloneDX SBOM start from, and the keyword list drops `quantum-safe`,
20
+ which was removed on purpose in an earlier release.
21
+
3
22
  ## 1.7.5
4
23
 
5
24
  Documentation. No source change.
package/LICENCE-PRODUCT.md CHANGED
@@ -90,7 +90,7 @@ The cryptography is NIST-standardised and the conformance is published, pinned a
90
90
  | Backend | OpenSSL 3.5 where the runtime provides it, `@noble/post-quantum` elsewhere. Identical on the wire, checked in both directions |
91
91
  | Conformance | 2,103 NIST ACVP vectors across FIPS 203, 204 and 205. Vectors pinned by digest |
92
92
  | Interoperability | 225 checks against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py |
93
- | Supply chain | SLSA provenance attestation on every release; CycloneDX SBOM; reproducible build |
93
+ | Supply chain | SLSA provenance attestation on every release since 1.4.0; CycloneDX SBOM; reproducible build |
94
94
  | Evidence bundle | `npm run evidence` regenerates all of it from source, on your machine |
95
95
  | On-chain verification | Armature L1 verifies ML-DSA-65 **in consensus** — `MLDSA65VerifyPrecompiledContract` at `0x0b`, executed by every validator, ~50,000 gas |
96
96
  | Accountability | Four **named** validators under QBFT proof-of-authority. Every block has an identified proposer and every write an accountable operator |
@@ -103,5 +103,5 @@ Dependency audit history — which upstream libraries were reviewed, by whom, an
103
103
 
104
104
  ## Support
105
105
 
106
- Commercial terms, seat pricing and SLA: **hello@kxco.ai**
106
+ Commercial terms, seat pricing and SLA: **admin@kxco.ai**
107
107
  Security and vulnerability reports: **john@knightsbridgelaw.com**, or a private advisory on the relevant repository. Full policy, including safe harbour for good-faith research: <https://kxco.ai/security>
package/NOTICE ADDED
@@ -0,0 +1,6 @@
1
+ kxco-post-quantum
2
+ Copyright 2026 Knightsbridge Financial Ltd, trading as KXCO.
3
+ Registered in England and Wales, company number 15684975.
4
+
5
+ Licensed under the Apache License, Version 2.0. See LICENSE.
6
+ https://kxco.ai
package/README.md CHANGED
@@ -17,7 +17,7 @@
17
17
  - **Interoperable by test.** 225 checks against liboqs, Bouncy Castle and the Python reference implementations, in both directions, 0 failed. See [CONFORMANCE.md](./CONFORMANCE.md).
18
18
  - **Native speed on Node 24.** The maths runs in OpenSSL 3.5 on Node 24 and later, and in JavaScript on Node 20, Node 22 and in browsers, with identical bytes on the wire.
19
19
  - **Speaks the formats your stack already parses.** Compact JWS and AKP JWK under the `ML-DSA-65` and `ML-DSA-87` algorithm names, and PKCS#8 seed-form keys.
20
- - **A supply chain you can check.** Reproducible builds, SLSA provenance and a CycloneDX SBOM on every release. Apache-2.0, with no licence check and nothing that phones home.
20
+ - **A supply chain you can check.** Reproducible builds verified in CI, with SLSA provenance and a CycloneDX SBOM on every release since 1.4.1. Apache-2.0, with no licence check and nothing that phones home.
21
21
 
22
22
  **The migration has dates.**
23
23
 
@@ -390,7 +390,7 @@ To report a vulnerability: [open a private security advisory](https://github.com
390
390
 
391
391
  ## License
392
392
 
393
- Apache-2.0. See [LICENSE](./LICENSE).
393
+ Apache-2.0 © 2026 Knightsbridge Financial Ltd, trading as KXCO. See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).
394
394
 
395
395
  ## Maintainers
396
396
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "kxco-post-quantum",
3
- "version": "1.7.5",
3
+ "version": "1.7.7",
4
4
  "description": "NIST post-quantum cryptography for Node.js and browsers: ML-DSA, ML-KEM and SLH-DSA (FIPS 203, 204, 205). 1,793 NIST ACVP vectors passed, 0 failed. OpenSSL 3.5 native on Node 24+, the CNSA 2.0 parameter sets, reproducible builds with provenance.",
5
5
  "keywords": [
6
6
  "post-quantum",
@@ -29,7 +29,6 @@
29
29
  "ml-dsa-87",
30
30
  "ml-kem-1024",
31
31
  "category-5",
32
- "quantum-safe",
33
32
  "pqc-migration",
34
33
  "cnsa-2.0",
35
34
  "crypto-agility",
@@ -142,6 +141,7 @@
142
141
  "HNDL.md",
143
142
  "LICENCE-PRODUCT.md",
144
143
  "LICENSE",
144
+ "NOTICE",
145
145
  "LIFECYCLE.md",
146
146
  "MIGRATION.md",
147
147
  "PQCMM.md",