kxco-post-quantum 1.7.6 → 1.7.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +11 -0
- package/LICENCE-PRODUCT.md +2 -2
- package/NOTICE +6 -0
- package/README.md +1 -1
- package/package.json +2 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 1.7.7
|
|
4
|
+
|
|
5
|
+
Documentation. No source change.
|
|
6
|
+
|
|
7
|
+
A NOTICE file names the copyright owner, Knightsbridge Financial Ltd, trading
|
|
8
|
+
as KXCO, and ships in the package, so anyone who redistributes it carries the
|
|
9
|
+
attribution, as section 4(d) of the Apache License requires.
|
|
10
|
+
|
|
11
|
+
LICENCE-PRODUCT.md dates SLSA provenance from 1.4.0, the first release that
|
|
12
|
+
carries it, and gives admin@kxco.ai for commercial terms.
|
|
13
|
+
|
|
3
14
|
## 1.7.6
|
|
4
15
|
|
|
5
16
|
Documentation. No source change.
|
package/LICENCE-PRODUCT.md
CHANGED
|
@@ -90,7 +90,7 @@ The cryptography is NIST-standardised and the conformance is published, pinned a
|
|
|
90
90
|
| Backend | OpenSSL 3.5 where the runtime provides it, `@noble/post-quantum` elsewhere. Identical on the wire, checked in both directions |
|
|
91
91
|
| Conformance | 2,103 NIST ACVP vectors across FIPS 203, 204 and 205. Vectors pinned by digest |
|
|
92
92
|
| Interoperability | 225 checks against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py |
|
|
93
|
-
| Supply chain | SLSA provenance attestation on every release; CycloneDX SBOM; reproducible build |
|
|
93
|
+
| Supply chain | SLSA provenance attestation on every release since 1.4.0; CycloneDX SBOM; reproducible build |
|
|
94
94
|
| Evidence bundle | `npm run evidence` regenerates all of it from source, on your machine |
|
|
95
95
|
| On-chain verification | Armature L1 verifies ML-DSA-65 **in consensus** — `MLDSA65VerifyPrecompiledContract` at `0x0b`, executed by every validator, ~50,000 gas |
|
|
96
96
|
| Accountability | Four **named** validators under QBFT proof-of-authority. Every block has an identified proposer and every write an accountable operator |
|
|
@@ -103,5 +103,5 @@ Dependency audit history — which upstream libraries were reviewed, by whom, an
|
|
|
103
103
|
|
|
104
104
|
## Support
|
|
105
105
|
|
|
106
|
-
Commercial terms, seat pricing and SLA: **
|
|
106
|
+
Commercial terms, seat pricing and SLA: **admin@kxco.ai**
|
|
107
107
|
Security and vulnerability reports: **john@knightsbridgelaw.com**, or a private advisory on the relevant repository. Full policy, including safe harbour for good-faith research: <https://kxco.ai/security>
|
package/NOTICE
ADDED
package/README.md
CHANGED
|
@@ -390,7 +390,7 @@ To report a vulnerability: [open a private security advisory](https://github.com
|
|
|
390
390
|
|
|
391
391
|
## License
|
|
392
392
|
|
|
393
|
-
Apache-2.0. See [LICENSE](./LICENSE).
|
|
393
|
+
Apache-2.0 © 2026 Knightsbridge Financial Ltd, trading as KXCO. See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).
|
|
394
394
|
|
|
395
395
|
## Maintainers
|
|
396
396
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-post-quantum",
|
|
3
|
-
"version": "1.7.
|
|
3
|
+
"version": "1.7.7",
|
|
4
4
|
"description": "NIST post-quantum cryptography for Node.js and browsers: ML-DSA, ML-KEM and SLH-DSA (FIPS 203, 204, 205). 1,793 NIST ACVP vectors passed, 0 failed. OpenSSL 3.5 native on Node 24+, the CNSA 2.0 parameter sets, reproducible builds with provenance.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|
|
@@ -141,6 +141,7 @@
|
|
|
141
141
|
"HNDL.md",
|
|
142
142
|
"LICENCE-PRODUCT.md",
|
|
143
143
|
"LICENSE",
|
|
144
|
+
"NOTICE",
|
|
144
145
|
"LIFECYCLE.md",
|
|
145
146
|
"MIGRATION.md",
|
|
146
147
|
"PQCMM.md",
|