kxco-pq-audit 1.2.0 → 1.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -7,6 +7,33 @@
|
|
|
7
7
|
|
|
8
8
|
Tamper-evident post-quantum audit log. Every operation produces an ML-DSA-65-signed entry chained to the previous via SHA-256. `verify()` replays the entire log — any gap, reorder, or edit breaks the chain or a signature.
|
|
9
9
|
|
|
10
|
+
## Release integrity
|
|
11
|
+
|
|
12
|
+
Every release of this package is checkable without asking us for anything.
|
|
13
|
+
|
|
14
|
+
- **Provenance.** Each release carries a SLSA provenance attestation tying the
|
|
15
|
+
published tarball to the commit and workflow that built it. Verify with
|
|
16
|
+
`npm audit signatures`, or read it directly from
|
|
17
|
+
`registry.npmjs.org/-/npm/v1/attestations/kxco-pq-audit@<version>`.
|
|
18
|
+
- **Bill of materials.** A CycloneDX SBOM is published as a GitHub Release asset
|
|
19
|
+
at `releases/download/v<version>/sbom.cyclonedx.json`, a permanent
|
|
20
|
+
unauthenticated URL. Not an expiring build artifact.
|
|
21
|
+
- **Pinned where it matters.** Third-party dependencies are pinned to exact
|
|
22
|
+
versions, never ranges, so the code that performs the cryptography cannot
|
|
23
|
+
change without a release. Sibling `kxco-*` packages sit on caret ranges
|
|
24
|
+
deliberately: it means a correctness fix in the base package reaches you
|
|
25
|
+
without a release of every package above it. That is not theoretical. When
|
|
26
|
+
`@noble/post-quantum` 0.7.1 was found to fail NIST SLH-DSA verification
|
|
27
|
+
vectors, the revert in the base package propagated here on the next install.
|
|
28
|
+
Every GitHub Action is pinned by 40-character commit SHA.
|
|
29
|
+
- **Conformance underneath.** The cryptography comes from
|
|
30
|
+
[`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum), which
|
|
31
|
+
is run against **2,103 NIST ACVP vectors (0 failed)** and a **225-check
|
|
32
|
+
cross-implementation interoperability matrix** against liboqs, Bouncy Castle
|
|
33
|
+
and two pure-Python implementations, in both directions and with negative
|
|
34
|
+
controls. Its published tarball also rebuilds bit-for-bit from its own tag,
|
|
35
|
+
verified in CI on every run.
|
|
36
|
+
|
|
10
37
|
## When to use this
|
|
11
38
|
|
|
12
39
|
Use this when you need a cryptographic proof that a sequence of operations happened, in order, and was not altered after the fact.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-pq-audit",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.2",
|
|
4
4
|
"description": "Tamper-evident post-quantum audit log for regulated institutions. ML-DSA-65-signed, SHA-256 hash-chained entries. Any tampering breaks the chain. Optional Armature L1 checkpoint anchoring via the KXCO relay.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|