kxco-verify 1.2.1 → 1.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -10,6 +10,29 @@ Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-65 s
|
|
|
10
10
|
|
|
11
11
|
---
|
|
12
12
|
|
|
13
|
+
## Release integrity
|
|
14
|
+
|
|
15
|
+
Every release of this package is checkable without asking us for anything.
|
|
16
|
+
|
|
17
|
+
- **Provenance.** Each release carries a SLSA provenance attestation tying the
|
|
18
|
+
published tarball to the commit and workflow that built it. Verify with
|
|
19
|
+
`npm audit signatures`, or read it directly from
|
|
20
|
+
`registry.npmjs.org/-/npm/v1/attestations/kxco-verify@<version>`.
|
|
21
|
+
- **Bill of materials.** A CycloneDX SBOM is published as a GitHub Release asset
|
|
22
|
+
at `releases/download/v<version>/sbom.cyclonedx.json`, a permanent
|
|
23
|
+
unauthenticated URL. Not an expiring build artifact.
|
|
24
|
+
- **Pinned, not floated.** Every runtime dependency is pinned to an exact
|
|
25
|
+
version, never a range, so the code that performs the cryptography cannot
|
|
26
|
+
change without a release of this package. Every GitHub Action is pinned by
|
|
27
|
+
40-character commit SHA.
|
|
28
|
+
- **Conformance.** The primitives are the same ones run against **2,103 NIST
|
|
29
|
+
ACVP vectors (0 failed)** and a **225-check cross-implementation
|
|
30
|
+
interoperability matrix** in
|
|
31
|
+
[`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum),
|
|
32
|
+
against liboqs, Bouncy Castle and two pure-Python implementations. This
|
|
33
|
+
package deliberately shares no code with the signer: a verifier that reached
|
|
34
|
+
the primitives through the same wrapper would be checking its own work.
|
|
35
|
+
|
|
13
36
|
## When to use this
|
|
14
37
|
|
|
15
38
|
This package is for the **receiving end** of a KXCO signed attestation — anyone who needs to confirm that a signature is genuine without being a KXCO institution or running the full SDK.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kxco-verify",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.3",
|
|
4
4
|
"description": "Standalone, browser-safe verifier for KXCO ML-DSA-65 post-quantum signed attestations and credentials, for auditors, regulators, counterparties, and anyone who needs to confirm a signature without running the full KXCO SDK.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"post-quantum",
|